{"data":{"id":"76a01b7c-2569-4719-89d2-e4b8dd746600","title":"CVE-2026-4269 - Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit","summary":"CVE-2026-4269 is a missing S3 ownership verification flaw in the Bedrock AgentCore Starter Toolkit before v0.1.13. A remote actor may inject code during the build process, leading to code execution in the AgentCore Runtime. Only users on versions before v0.1.13 who built the toolkit after September 24, 2025 are affected.","solution":"Upgrade to v0.1.13 or later.","labels":["security","industry"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-008-aws/","publishedAt":"2026-03-16T18:59:47.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon Bedrock AgentCore Starter Toolkit","AWS Bedrock AgentCore Runtime"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-03-16T18:59:47.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}