From the AWS edition of November 6, 2026
AWS Security Bulletin 2026-065: AgentCore Python SDK install_packages() CVE-2026-16796 fixed in bedrock-agentcore 1.18.1 (why-now with GovCloud Agent Registry)
Amazon Web Services · Cloud security / generative AI tooling · Global AWS customers using bedrock-agentcore SDK (including GovCloud AgentCore programs)
- Publisher
- AWS Security Bulletins
- Original publication
- 2026-07-23
- Source retrieved
- 2026-11-07
- Event date
- 2026-07-23
What happened
AWS Security Bulletin 2026-065-AWS (publication date 07/23/2026) describes CVE-2026-16796 in the Bedrock AgentCore Python SDK Code Interpreter client's install_packages() method: improper neutralization of argument delimiters that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. Impacted versions are bedrock-agentcore <1.18.1. AWS says the issue is addressed in 1.18.1 and recommends upgrading and patching forks. If unable to upgrade, AWS says not to pass untrusted or model-generated input to install_packages(), and to validate dynamic names against strict PyPI rules. Why-now for the 2026-11-06 edition: Agent Registry GA in GovCloud (US-West) expands governed discovery of agents and MCP tools, so public-sector AgentCore programs inventorying tools should also verify SDK versions and Code Interpreter execution-role posture—not treat a catalog alone as hardening.
Why it matters
Newly relevant alongside today's GovCloud Agent Registry launch: SLED AgentCore programs adding a tool catalog still need SDK patch levels and least-privilege interpreters.
Evidence and measured results
AWS security bulletin acknowledging the CVE and fix; independent BeyondTrust write-up opened via WebFetch (curl 403) as corroborating context, not a separate filed resource.
Limitations and uncertainty
Bulletin date is July 2026; included for why-now linkage to Nov 6 Agent Registry, not as fresh product news. Bulletin does not claim active exploitation in SLED.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-07; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies expanding AgentCore tool catalogs still need patched bedrock-agentcore SDKs and least-privilege Code Interpreters.
- Stakeholders
- Platform security
- Agent application owner
- Registry curator
- CISO
- Discovery questions
- What bedrock-agentcore versions are in production images?
- Which Code Interpreters have execution roles?
- Does curator policy require a minimum SDK version?
- Value hypothesis
- Combining registry governance with SDK/interpreter baselines may reduce avoidable sandbox RCE exposure; this bulletin alone does not prove current exploitability.
- Potential engagement
- SDK and interpreter posture review timed with the GovCloud Agent Registry pilot.
- Unsupported claims
- Active exploitation in a named SLED agency
- That the bulletin is a Nov 2026 discovery
- That registry use remediates the CVE
Pre-sales engineering
Role takeaway
- Fit
- Fit for AgentCore programs, especially those adopting Agent Registry in GovCloud US-West.
- Architecture and integration
- Pin bedrock-agentcore >=1.18.1; validate package names; separate registry approval from runtime patch evidence.
- Prerequisites
- Image/SBOM inventory
- CI version gate
- Interpreter execution-role review
- Constraints
- Bulletin is July 2026
- Forks may lag
- Catalog approval != patch status
- Security
- Upgrade to 1.18.1+; avoid untrusted/model-generated package names; prefer no execution role when possible.
- Proof of value
- All prod images report >=1.18.1
- Untrusted install_packages path blocked in test
- Interpreters without AWS API need have no execution role
Delivery
Role takeaway
- Work
- Inventory, patch, and update curator checklist during registry pilot.
- Dependencies
- CI/CD
- Agent owners
- Security operations
- Ownership
- Platform security owns baseline; curators enforce checklist; app teams patch images.
- Skills and adoption
- SDK versioning, interpreter IAM, secure packaging practices.
- Governance checkpoints
- Minimum SDK version in curator policy
- Patch completion review
- Exception register for forks
- Acceptance criteria
- Proposed: zero prod images <1.18.1
- Proposed: curator checklist includes SDK gate
- Proposed: execution-role justification documented
- Risks
- False sense of safety from catalog alone
- Unpatched forks
- Lingering untrusted package-name paths
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Affects SDK helper that builds pip install commands for Code Interpreter sandboxes; Runtime/registry catalog is separate from this patch surface.
Governance
Who approves, reviews and stays accountable for outcomes?
Patch and input-validation policy should be part of curator/publisher standards when registering Code Interpreter-using agents.
Security and privacy
What data, permissions and controls need testing?
Command execution risk inside sandbox; credential exposure depends on whether an execution role is attached, per related independent research context.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
None reported.
Procurement
What should contracts, pricing and exit terms secure?
Open-source SDK upgrade; no new paid SKU.
Operating model
Which teams own the service once it runs?
Inventory bedrock-agentcore versions in CI and agent images; block untrusted package-name paths.
Publication history
- 2026-11-06AWS · Issue 095 resources
Stable resource ID: aws-bulletin-agentcore-sdk-cve-2026-16796-why-now-20261106