CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Summary

CVE-2026-16796 is an improper neutralization of argument delimiters in the install_packages() method of the AWS Bedrock AgentCore Python SDK (bedrock-agentcore), which provides a Code Interpreter client that installs Python packages into a managed sandbox. The flaw might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments; affected versions are bedrock-agentcore versions earlier than 1.18.1.

Mitigation

Fixed in bedrock-agentcore 1.18.1 or later.

Related items

• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database