{"data":{"id":"9c64b991-5ce0-42bc-8e78-27b04bec0a27","title":"CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation","summary":"CVE-2026-18830 affects the InvokeHarness API in Amazon Bedrock AgentCore harness, prior to July 31, 2026. When the most recent message in a request contained a tool-use content block, an authenticated user could have the agent event loop dispatch the named tool directly, bypassing model invocation and associated security controls. Impact was limited to tools configured on the harness; a harness with no configured tools could not execute any tool.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-073-aws/","publishedAt":"2026-08-04T17:45:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon Bedrock AgentCore harness","Amazon Bedrock"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-08-04T17:45:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}