AgentCore CLI CVE-2026-11393

Attacker must (1) hold authenticated AWS credentials with permission to set the collaborationInstruction field on a Bedrock Agent collaborator in the target account, and (2) induce a second user in the same AWS account to run the AgentCore CLI import command against that collaborator - UI:R in the CVSS vector reflects this required victim action. Exploitation is limited to environments where AgentCore CLI before v0.14.2 (or preview before 1.0.0-preview.9) is installed and used to import Bedrock collaborators authored by another principal; deployments that do not use cross-user Bedrock collaborator sharing, or that have already upgraded, are not exposed. No special CLI flags or non-default configuration are required beyond normal use of the import command.

The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H yields 9.0 and reflects the cross-tenant blast radius: a low-privileged authenticated actor in one AWS account context plants a payload, and a second user's import (UI:R) detonates it, with Scope:Changed because execution spreads to AgentCore Runtime under a different IAM role plus the victim's local workstation. Reported by AMZN with a vendor advisory (aws.amazon.com/security/security-bulletins/2026-040-aws/) and a GitHub Security Advisory (GHSA-m4x6-gwgp-4pm7), so the bug is vendor-confirmed and patched. There is no EPSS score or KEV listing provided, and no public exploit identified at time of analysis - exploitation requires UI:R plus the social-engineering step of convincing a same-account collaborator to import the poisoned agent, which constrains opportunistic mass exploitation but makes it a credible insider-threat / supply-chain risk inside AWS organizations using Bedrock multi-agent setups. Treat as a real priority for any team using AgentCore CLI to import third-party or cross-team Bedrock collaborators.

An attacker with permission to update a Bedrock Agent collaborator in a shared AWS account sets its collaborationInstruction to a string that closes the generated Python triple-quoted docstring and appends malicious Python (for example, code that exfiltrates AWS credentials or writes an SSH key). A teammate later runs agentcore import to pull that collaborator into their own workflow; the CLI emits and executes the poisoned Python both locally on the teammate's workstation and on AWS AgentCore Runtime under the imported agent's IAM execution role, giving the attacker code execution in two distinct trust contexts. No public PoC is identified, but the upstream commit message names the exact sink ("escape triple-quotes in collaborationInstruction to prevent docstring injection"), making PoC construction straightforward for a knowledgeable attacker.