CVE-2026-12530 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Summary

CVE-2026-12530 affects the install_packages() method of the Code Interpreter client in the AWS Bedrock AgentCore Python SDK (bedrock-agentcore), versions >= 1.1.3 and < 1.6.1. The method sanitized package name arguments with an incomplete blocklist before building a 'pip install' command in the Code Interpreter sandbox, letting crafted arguments bypass validation. The most serious bypasses were the '--index-url' flag, which could redirect package resolution to a third-party-controlled PyPI server, and the '-r' flag, which could read and expose arbitrary sandbox files.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database