Bedrock AgentCore SDK CVE-2026-16796

Exploitation requires an authenticated AgentCore user (CVSS PR:L) and active user interaction (UI:A), and specifically requires that the crafted, attacker-controlled input reaches the install_packages() method of the Bedrock AgentCore Python SDK as a package name argument - i.e. a code path or agent workflow that installs packages using caller-supplied names. The exact concrete prerequisite is that the application invokes install_packages() with a package name string that the attacker can influence within a Code Interpreter sandbox session on an SDK version earlier than 1.18.1. Limiting factors that constrain real-world risk: the attacker must already be an authorized user of the AgentCore environment, some user/agent interaction must trigger the vulnerable install call, and the impact is contained to the Code Interpreter sandbox (no confirmed subsequent-system or host impact, availability impact None).

The signals are moderately concerning but not emergency-tier. The CVSS 4.0 base score is 8.4 (High) with a network attack vector, low attack complexity (AV:N/AC:L/AT:N) and high confidentiality/integrity impact (VC:H/VI:H), but two factors materially lower real-world risk: PR:L means the attacker must already be an authenticated user of the AgentCore environment, and UI:A means active user interaction is part of the attack path. Availability impact is None and there is no subsequent-system impact (SC/SI/SA:N), so the blast radius is scoped to the Code Interpreter sandbox rather than the broader host. EPSS is not provided in the input, so exploitation probability cannot be quantified, and there is no KEV listing and no evidence of a public PoC - so this is a real priority to patch for anyone running AgentCore agents, but not currently mass-exploited. Note a mild tension worth verifying: the CVSS labels the vector as network (AV:N) while exploitation fundamentally depends on being an authorized AgentCore user submitting package input, so treat 'remote' as 'remote authenticated tenant', not anonymous internet-facing.

An authenticated user (or an agent whose package input the user can influence) submits a crafted package name containing argument delimiters to a workflow that calls install_packages(); the delimiters are interpreted as extra command options or a chained command, causing arbitrary commands to run inside the Code Interpreter sandbox. Because the attack requires active user interaction and authenticated access, a realistic path is a malicious or manipulated agent instruction that supplies the poisoned package string during a code-execution session. No public exploit code has been identified at time of analysis.