Which versions of Bedrock AgentCore SDK are affected by EUVD-2026-48422?

AWS Bedrock AgentCore Python SDK versions prior to 1.18.1 contain a vulnerability allowing authenticated users to execute unauthorized code within production AI deployments, potentially compromising…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-48422?

Yes, a public proof-of-concept exploit is available for EUVD-2026-48422. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-48422?

Within 24 hours, inventory all systems running AWS Bedrock AgentCore Python SDK and identify those on versions prior to 1.18.1. Within 7 days, deploy version 1.18.1 or later to staging environments, conduct regression testing, and obtain production deployment approval. Within 30 days, complete rollout of the patched SDK version to all production environments and confirm all instances are running 1.18.1 or later.

Bedrock AgentCore SDK EUVD-2026-48422

Q: What is the CVSS score of EUVD-2026-48422?

EUVD-2026-48422 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-16796 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-23 AMZN

GHSA-j6g5-3hh3-pgw8

RCE Python AWS Bedrock Agentcore 1 18 1

8.4

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Authenticated user supplies input (PR:L) with required interaction (UI:R); command execution stays within the sandbox authority (S:U) yielding high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 21:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 21:23 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 21:23 NVD

7.3 (HIGH) 8.4 (HIGH)

Analysis Generated

Jul 23, 2026 - 20:50 vuln.today

CVE Published

Jul 23, 2026 - 20:06 cve.org

HIGH 7.3

DescriptionCVE.org

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

To mitigate this issue, users should upgrade to the patched version 1.18.1.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 1 Critical, 2 High Severity Jul 24, 2026

AnalysisAI

Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary commands inside the Code Interpreter sandbox by embedding shell/argument delimiters in package names passed to install_packages(). Because the CVSS vector is PR:L, an attacker needs some level of authenticated access and the flaw requires user interaction (UI:A) with a high confidentiality and integrity impact (CVSS 4.0 base 8.4). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the AWS Bedrock AgentCore Python SDK, the client library used to build and orchestrate agents on Amazon Bedrock AgentCore, which includes a managed Code Interpreter sandbox for executing agent-generated code and installing dependencies. The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command, 'Argument Injection'): the install_packages() method passes user-influenced package name strings into an underlying package-installation command without properly neutralizing argument delimiters (such as spaces, dashes introducing new flags, or shell metacharacters). This allows crafted 'package name' input to be reinterpreted as additional command-line options or separate commands, turning a dependency-install feature into an arbitrary command execution primitive within the sandbox. The CPE identifies the affected package as cpe:2.3:a:aws:bedrock-agentcore_1.18.1, i.e. the bedrock-agentcore Python distribution on PyPI prior to 1.18.1.

RemediationAI

Vendor-released patch: upgrade the bedrock-agentcore Python package to version 1.18.1 or later (for example via 'pip install --upgrade bedrock-agentcore==1.18.1'), as directed by AWS security bulletin 2026-065 (https://aws.amazon.com/security/security-bulletins/2026-065-aws/) and advisory GHSA-j6g5-3hh3-pgw8. This is the primary and authoritative fix. Until the upgrade is deployed, reduce exposure by not passing untrusted or agent/LLM-generated package names directly into install_packages(): validate package names against a strict allowlist or a conservative regex (letters, digits, dots, hyphens, underscores only, rejecting whitespace, leading dashes, and shell metacharacters), and pin dependencies to a vetted manifest rather than accepting free-form package arguments - the trade-off is reduced flexibility for agents that dynamically install packages. Because impact is confined to the Code Interpreter sandbox, also review and tighten the sandbox's outbound network and permission scope so that even successful in-sandbox command execution cannot reach sensitive resources.