Read the docs
TI-2026-69048 Aliases CVE-2026-106032

Server-side request forgery in Bedrock AgentCore Starter Toolkit

Priority LOW 25CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Amazon Bedrock AgentCore Starter Toolkit versions from 0.1.4 through 0.3.13 are affected. The OpenAPI schema processing during agent import is vulnerable to server-side request forgery (CWE-918) through crafted external reference values. An authenticated remote user in the same AWS account can make the environment of a user importing a Bedrock Agent issue arbitrary outbound requests and read arbitrary local files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files, via crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group. To remediate this issue, users should upgrade to version 0.3.14. Note that bedrock-agentcore-starter-toolkit is deprecated. The @aws/agentcore npm CLI is the supported replacement and does not contain this issue. Migration to @aws/agentcore is the recommended long-term path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSbedrock-agentcore-starter-toolkit0.1.4 – 0.3.13—No fix listedCNA
  • bedrock-agentcore-starter-toolkit VendorAWS Affected 0.1.4 – 0.3.13 Fixed in — No fix listed CNA

Remediation

Upgrade the Amazon Bedrock AgentCore Starter Toolkit to version 0.3.14. The bedrock-agentcore-starter-toolkit package is deprecated, and the @aws/agentcore npm CLI is the supported replacement that does not contain this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-106032
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 1

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences