Read the docs
TI-2026-03714 Aliases CVE-2026-4269GHSA-xfhr-q72q-jcrj

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Priority LOW 28CWE-283Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who build or have built the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users on previous versions who built the toolkit before September 24, 2025 are not affected. To remediate this issue, customers should upgrade to version v0.1.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed Bedrock AgentCore Starter Toolkit (AWS): 0.1.13bedrock-agentcore-starter-toolkit (PyPI): 0.1.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSBedrock AgentCore Starter Toolkit0.1.0 to before 0.1.130.1.13Patch availableCNA
—bedrock-agentcore-starter-toolkit (PyPI)before 0.1.130.1.13Patch availableGHSA-xfhr-q72q-jcrj
  • Bedrock AgentCore Starter Toolkit VendorAWS Affected 0.1.0 to before 0.1.13 Fixed in 0.1.13 Patch available CNA
  • bedrock-agentcore-starter-toolkit (PyPI) Vendor— Affected before 0.1.13 Fixed in 0.1.13 Patch available GHSA-xfhr-q72q-jcrj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amazon:bedrock_agentcore_starter_toolkit:*:*:*:*:*:python:*:*before 0.1.13VulnerableAWS
  • cpe:2.3:a:amazon:bedrock_agentcore_starter_toolkit:*:*:*:*:*:python:*:* Versions before 0.1.13 Vulnerable ·AWS

Remediation

  • Fix · CNA Bedrock AgentCore Starter Toolkit (AWS) Fixed in 0.1.13
  • Fix · GHSA-xfhr-q72q-jcrj bedrock-agentcore-starter-toolkit (PyPI) Fixed in 0.1.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4269
  2. 2026-10-03 Alias added: GHSA-xfhr-q72q-jcrj

References

Patch 1

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences