CVE-2026-4269: Bedrock AgentCore Starter Toolkit Code Injection Vulnerability
Summary
CVE-2026-4269: Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit. Affects bedrock-agentcore-starter-toolkit versions < 0.1.13. Fixed in 0.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bedrock AgentCore Starter Toolkit is a Python package designed to facilitate the development and deployment of agent-based applications. It provides essential tools and libraries for building agent cores, enabling developers to create robust and scalable solutions. However, versions prior to v0.1.13 are susceptible to a significant security flaw that can be exploited during the build process.
Vulnerability Detail
An improper ownership verification issue has been identified in the Bedrock AgentCore Starter Toolkit, specifically in versions before v0.1.13. This vulnerability allows a remote actor to inject malicious code during the build process, potentially leading to code execution within the AgentCore Runtime. The ramifications include a complete loss of confidentiality, integrity, and availability of the affected resources, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
0.1.13
This is the first release that contains the fix.
pip install --upgrade "bedrock-agentcore-starter-toolkit==0.1.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version.
Conclusion
The Bedrock AgentCore Starter Toolkit has a critical vulnerability that allows for remote code injection, affecting all versions prior to v0.1.13 built after September 24, 2025. Users are strongly advised to upgrade to the latest version to ensure the security of their applications.
See every vulnerability recorded for bedrock-agentcore-starter-toolkit →
FAQ
All versions prior to v0.1.13 are affected, specifically those built after September 24, 2025.
The vulnerability allows remote code injection during the build process, leading to potential code execution and a complete loss of confidentiality, integrity, and availability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, the issue has been addressed in version v0.1.13 of the Bedrock AgentCore Starter Toolkit. Users should upgrade to this version or later.
While there are no specific workarounds, it is crucial to prioritize upgrading to the patched version to mitigate the risk of exploitation.
