EUVD-2026-52819
GHSA-h8gv-mm2p-4q56
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API access requires authenticated PR:L; crafted content blocks exploit validation gap without interaction; no scope change or availability impact indicated.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.
AnalysisAI
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid AWS identity with authenticated access to an Amazon Bedrock AgentCore agent (PR:L per CVSS 4.0 vector), specifically the ability to submit conversation messages to the AgentCore harness API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) scores 8.6, reflecting network-accessible exploitation with low complexity, no attack target preconditions, and no user interaction required - but constrained by the requirement for low-privilege authenticated access (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated AWS principal with permission to interact with a Bedrock AgentCore agent constructs a conversation message containing a crafted content block that exploits the insufficient input validation to directly signal tool invocation without routing through the model inference step. The AgentCore harness processes the malformed block and executes the targeted tool - for example, a tool with permissions to read from an S3 bucket or query a connected database - returning results to the attacker outside the visibility of model-layer safety controls. … |
| Remediation | AWS has fully deployed a server-side fix for this vulnerability; no customer action is required to receive the patch, as Amazon Bedrock AgentCore is a managed service. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm with AWS that your Bedrock environment is running the fully remediated version (AWS-managed server-side fix requires no customer patch installation). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today