{"resourceId":"aws-bulletin-agentcore-starter-toolkit-import-code-injection-ssrf-20261006","versions":[{"version":"external-46b8a803c60d516aa4ca6cdd1f4d0db90ddcba76b935b1c4abf79657cbc8f309","resource":{"id":"aws-bulletin-agentcore-starter-toolkit-import-code-injection-ssrf-20261006","title":"AWS security bulletin: deprecated Bedrock AgentCore Starter Toolkit import flaws (CVE-2026-105812, CVE-2026-106032) require re-importing agents, as AgentCore CLI 1.0 becomes the replacement","organization":"Amazon Web Services","sector":"AI agent development tooling; software supply chain","geography":"Global (AWS open-source tooling)","publishedAt":"2026-10-06","publicationDate":"2026-10-06","eventDate":"2026-10-28","sourceName":"AWS Security Bulletins","sourceLabel":"CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF","sourceUrl":"https://aws.amazon.com/security/security-bulletins/2026-127-aws/","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security"],"finding":"AWS bulletin 2026-127-AWS (published Oct 6, marked Important) reports two issues in the open-source bedrock-agentcore-starter-toolkit, versions 0.1.4 through 0.3.13: CVE-2026-105812, code injection allowing arbitrary code execution when a crafted Bedrock Agent is imported and then run or deployed, and CVE-2026-106032, external reference handling that could cause unintended network requests or local file access during import. Version 0.3.14 fixes both. AWS says agents imported with affected versions must be re-imported and their local and deployed artifacts replaced. The toolkit was deprecated on March 27, 2026, and AWS recommends migrating to the AgentCore CLI (@aws/agentcore). On Oct 28 AWS made AgentCore CLI 1.0 generally available with an agentcore migrate command, which makes the migration step concrete now.","sledRelevance":"Universities and state agency teams that prototyped Bedrock Agents and moved them to AgentCore with the starter toolkit may hold deployed artifacts produced by a vulnerable importer. The risk is highest where several principals share one AWS account, which is common in campus research accounts and shared state platforms. Why now: the replacement CLI reached 1.0 on Oct 28, so remediation and migration can be scheduled together.","evidence":"Vendor security bulletin with affected versions, fixed version and workaround; acknowledgement to an external researcher. CLI 1.0 availability confirmed from the Oct 28 AWS What's New post. No exploitation data reported.","architectureImplications":"The flaw sits in the import path that converts Bedrock Agents into AgentCore projects; replacement tooling is the AgentCore CLI 1.0 with a migrate command for existing projects.","governanceImplications":"Agent development pipelines need software bill of materials tracking for AWS-supplied developer tooling, not just runtime services, and a rule for retiring deprecated tools.","securityPrivacyImplications":"Crafted agent data modified by another principal in the same account could execute code during import; shared accounts increase exposure. Artifacts generated by vulnerable versions must be replaced, not just the tool upgraded.","caveats":"Bulletin predates the last run window; included because the Oct 28 CLI 1.0 release makes the recommended migration actionable. No evidence of exploitation. CVE identifiers are as published by AWS.","streamIds":["aws"],"roles":{"sales":"Use this as a hygiene conversation, not a scare. Campus and state teams that built early Bedrock agents with AWS's starter toolkit may be running artifacts from a vulnerable importer, and AWS says those must be regenerated. Offer a short agent-tooling review: which agents exist, how they were built, and whether migration to the new AgentCore CLI 1.0 should happen now. Do not imply exploitation; AWS reports none.","engineering":"Engineering should inventory every AgentCore project and determine the toolkit version used for import. Agents built with 0.1.4 through 0.3.13 need re-import with 0.3.14 or the new CLI, and both local and deployed outputs replaced. Check whether other principals could modify Bedrock Agent data in shared accounts. Plan migration with agentcore migrate under CLI 1.0, and add developer tooling versions to dependency scanning.","delivery":"Delivery should turn the bulletin into a tracked remediation ticket per agent, with an owner and due date. Record import history where possible; where it is unknown, treat the artifact as affected. Schedule CLI 1.0 migration alongside remediation to avoid doing the work twice. Proposed acceptance criteria are a complete agent inventory, zero artifacts from affected versions remaining in deployment, and the deprecated toolkit removed from build pipelines."},"roleDetails":{"sales":{"customerProblem":"Teams that built Bedrock agents early may run artifacts generated by a vulnerable, now-deprecated AWS importer.","stakeholders":["University research computing director","State agency application security lead","Agent development team lead"],"discoveryQuestions":["Which AgentCore agents were imported from Bedrock Agents, and with what tool version?","Do multiple principals share the AWS accounts that host agents?","Is the deprecated starter toolkit still in any build pipeline?"],"valueHypothesis":"A focused review can close a known tooling vulnerability and move teams onto supported tooling in one pass.","potentialEngagement":"Two-week agent tooling inventory and remediation plan.","unsupportedClaims":["That any SLED agent was exploited","That upgrading the tool alone fixes deployed agents"]},"engineering":{"fit":"Any team that used bedrock-agentcore-starter-toolkit import commands.","architectureIntegration":"Replace starter-toolkit workflows with AgentCore CLI 1.0 and agentcore migrate; regenerate artifacts.","prerequisites":["Inventory of AgentCore projects","Access to build history","AgentCore CLI 1.0 installed"],"constraints":["Import history may be unrecorded","Shared accounts complicate trust in agent data"],"security":"Treat artifacts from versions 0.1.4 to 0.3.13 as untrusted until regenerated; restrict who can modify Bedrock Agent data.","proofOfValue":["Dependency scan shows no affected toolkit versions","Redeployed agents pass existing functional tests","Pipeline no longer references the deprecated toolkit"]},"delivery":{"work":"Inventory, re-import or migrate, redeploy and verify all affected agents.","dependencies":["Application owner testing time","CLI 1.0 migration compatibility"],"ownership":"Application security lead with each agent's product owner.","skillsAdoption":"Developers adopt CLI 1.0 command structure and migration workflow.","governanceCheckpoints":["Inventory sign-off","Remediation verification per agent","Removal of deprecated tooling"],"acceptanceCriteria":["Proposed: 100% of agents inventoried with tool version","Proposed: zero deployed artifacts from affected versions","Proposed: deprecated toolkit absent from pipelines"],"risks":["Unknown import history leaves gaps","Migration breaks agent behaviour","Remediation deprioritised without known exploitation"]}},"retrievedAt":"2026-11-01T03:09:32Z","enrichedAt":"2026-11-01T03:16:34Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Developer teams need time and guidance to migrate to new CLI conventions.","procurementImplications":"No procurement impact; open-source tooling.","operatingModelImplications":"Remediation requires inventory of which agents were imported, by whom and with which version, which many teams will not have recorded.","sourceVerification":{"openedUrl":"https://aws.amazon.com/security/security-bulletins/2026-127-aws/","referenceExcerpt":"Agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}