Which versions of Bedrock Agentcore Starter Toolkit are affected by CVE-2026-4269?

Organizations using the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 face a code injection risk during the build process that could lead to unauthorized code execution in production…. A patch is available.

How to fix or mitigate CVE-2026-4269?

Within 24 hours: Identify all internal builds of AgentCore Starter Toolkit created after September 24, 2025 and document toolkit versions in use. Within 7 days: Upgrade to version v0.1.13 or later; if unable to upgrade immediately, isolate affected build environments from production networks. Within 30 days: Complete full migration to v0.1.13+, conduct code review of any artifacts built with vulnerable versions, and implement build pipeline security scanning.

Bedrock Agentcore Starter Toolkit CVE-2026-4269

Q: What is the CVSS score of CVE-2026-4269?

CVE-2026-4269 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12490 MEDIUM

Unverified Ownership (CWE-283)

2026-03-16 ff89ba41-3aa1-4d27-914a-91399e9639e5

GHSA-xfhr-q72q-jcrj

RCE Bedrock Agentcore Starter Toolkit

5.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 14:37 NVD

HIGH MEDIUM

CVSS changed

May 11, 2026 - 14:37 NVD

7.5 (HIGH) 5.8 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 18:30 euvd

EUVD-2026-12490

Analysis Generated

Mar 16, 2026 - 18:30 vuln.today

CVE Published

Mar 16, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who build or have built the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users on previous versions who built the toolkit before September 24, 2025 are not affected.

To remediate this issue, customers should upgrade to version v0.1.13.

AnalysisAI

Remote code execution in Bedrock AgentCore Starter Toolkit versions before v0.1.13 allows unauthenticated attackers to inject malicious code during the build process by exploiting missing S3 ownership verification, affecting only users who built the toolkit after September 24, 2025. An attacker can achieve arbitrary code execution within the AgentCore Runtime environment. Users must upgrade to version v0.1.13 to remediate this vulnerability, as no patch is currently available for earlier versions.

Technical ContextAI

The Bedrock AgentCore Starter Toolkit is an AWS development framework for building AI agent applications on Amazon Bedrock. The vulnerability stems from CWE-283 (Unverified Ownership), which occurs when the system fails to properly verify that a resource (in this case, an S3 bucket) is owned by the expected party. During the build process, the toolkit retrieves artifacts from S3 without validating bucket ownership, allowing an adversary who controls or has taken over the expected S3 resource to supply malicious build artifacts. This supply chain vulnerability represents a build-time code injection attack where untrusted input is incorporated into the runtime environment without proper verification of its provenance.

RemediationAI

Customers should immediately upgrade to Bedrock AgentCore Starter Toolkit version v0.1.13 or later, available from the GitHub repository at https://github.com/aws/bedrock-agentcore-starter-toolkit/releases/tag/v0.1.13. Organizations that built the toolkit after September 24, 2025 using vulnerable versions should treat their runtime environments as potentially compromised and perform security audits to verify the integrity of build artifacts and runtime components. Review AWS CloudTrail logs for suspicious S3 access patterns during build operations and validate the ownership and integrity of all S3 buckets used in the build pipeline. Implement S3 bucket ownership verification controls and restrict bucket access using IAM policies and S3 bucket policies to prevent unauthorized resource substitution. Consult the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-008-AWS/ for additional guidance.