From the AWS edition of October 31, 2026
AWS security bulletin: deprecated Bedrock AgentCore Starter Toolkit import flaws (CVE-2026-105812, CVE-2026-106032) require re-importing agents, as AgentCore CLI 1.0 becomes the replacement
Amazon Web Services · AI agent development tooling; software supply chain · Global (AWS open-source tooling)
- Publisher
- AWS Security Bulletins
- Original publication
- 2026-10-06
- Source retrieved
- 2026-11-01
- Event date
- 2026-10-28
What happened
AWS bulletin 2026-127-AWS (published Oct 6, marked Important) reports two issues in the open-source bedrock-agentcore-starter-toolkit, versions 0.1.4 through 0.3.13: CVE-2026-105812, code injection allowing arbitrary code execution when a crafted Bedrock Agent is imported and then run or deployed, and CVE-2026-106032, external reference handling that could cause unintended network requests or local file access during import. Version 0.3.14 fixes both. AWS says agents imported with affected versions must be re-imported and their local and deployed artifacts replaced. The toolkit was deprecated on March 27, 2026, and AWS recommends migrating to the AgentCore CLI (@aws/agentcore). On Oct 28 AWS made AgentCore CLI 1.0 generally available with an agentcore migrate command, which makes the migration step concrete now.
Why it matters
Universities and state agency teams that prototyped Bedrock Agents and moved them to AgentCore with the starter toolkit may hold deployed artifacts produced by a vulnerable importer. The risk is highest where several principals share one AWS account, which is common in campus research accounts and shared state platforms. Why now: the replacement CLI reached 1.0 on Oct 28, so remediation and migration can be scheduled together.
Evidence and measured results
Vendor security bulletin with affected versions, fixed version and workaround; acknowledgement to an external researcher. CLI 1.0 availability confirmed from the Oct 28 AWS What's New post. No exploitation data reported.
Limitations and uncertainty
Bulletin predates the last run window; included because the Oct 28 CLI 1.0 release makes the recommended migration actionable. No evidence of exploitation. CVE identifiers are as published by AWS.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-01; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Teams that built Bedrock agents early may run artifacts generated by a vulnerable, now-deprecated AWS importer.
- Stakeholders
- University research computing director
- State agency application security lead
- Agent development team lead
- Discovery questions
- Which AgentCore agents were imported from Bedrock Agents, and with what tool version?
- Do multiple principals share the AWS accounts that host agents?
- Is the deprecated starter toolkit still in any build pipeline?
- Value hypothesis
- A focused review can close a known tooling vulnerability and move teams onto supported tooling in one pass.
- Potential engagement
- Two-week agent tooling inventory and remediation plan.
- Unsupported claims
- That any SLED agent was exploited
- That upgrading the tool alone fixes deployed agents
Pre-sales engineering
Role takeaway
- Fit
- Any team that used bedrock-agentcore-starter-toolkit import commands.
- Architecture and integration
- Replace starter-toolkit workflows with AgentCore CLI 1.0 and agentcore migrate; regenerate artifacts.
- Prerequisites
- Inventory of AgentCore projects
- Access to build history
- AgentCore CLI 1.0 installed
- Constraints
- Import history may be unrecorded
- Shared accounts complicate trust in agent data
- Security
- Treat artifacts from versions 0.1.4 to 0.3.13 as untrusted until regenerated; restrict who can modify Bedrock Agent data.
- Proof of value
- Dependency scan shows no affected toolkit versions
- Redeployed agents pass existing functional tests
- Pipeline no longer references the deprecated toolkit
Delivery
Role takeaway
- Work
- Inventory, re-import or migrate, redeploy and verify all affected agents.
- Dependencies
- Application owner testing time
- CLI 1.0 migration compatibility
- Ownership
- Application security lead with each agent's product owner.
- Skills and adoption
- Developers adopt CLI 1.0 command structure and migration workflow.
- Governance checkpoints
- Inventory sign-off
- Remediation verification per agent
- Removal of deprecated tooling
- Acceptance criteria
- Proposed: 100% of agents inventoried with tool version
- Proposed: zero deployed artifacts from affected versions
- Proposed: deprecated toolkit absent from pipelines
- Risks
- Unknown import history leaves gaps
- Migration breaks agent behaviour
- Remediation deprioritised without known exploitation
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The flaw sits in the import path that converts Bedrock Agents into AgentCore projects; replacement tooling is the AgentCore CLI 1.0 with a migrate command for existing projects.
Governance
Who approves, reviews and stays accountable for outcomes?
Agent development pipelines need software bill of materials tracking for AWS-supplied developer tooling, not just runtime services, and a rule for retiring deprecated tools.
Security and privacy
What data, permissions and controls need testing?
Crafted agent data modified by another principal in the same account could execute code during import; shared accounts increase exposure. Artifacts generated by vulnerable versions must be replaced, not just the tool upgraded.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Developer teams need time and guidance to migrate to new CLI conventions.
Procurement
What should contracts, pricing and exit terms secure?
No procurement impact; open-source tooling.
Operating model
Which teams own the service once it runs?
Remediation requires inventory of which agents were imported, by whom and with which version, which many teams will not have recorded.
Publication history
- 2026-10-31AWS · Issue 037 resources
Stable resource ID: aws-bulletin-agentcore-starter-toolkit-import-code-injection-ssrf-20261006