AI & LLM Vulnerabilities

A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.

A prompt injection vulnerability (tricking an AI by hiding instructions in its input) in the shell tool of Amazon Strands Agents Tools before version 0.8.0 allows attackers to run arbitrary operating system commands on the agent's host computer by crafting a prompt that sets the non_interactive parameter to true, which bypasses the requirement for human approval.

AWS Bedrock AgentCore Python SDK has a vulnerability in the install_packages() method where improper input validation allows remote authenticated users to execute arbitrary commands in a Code Interpreter sandbox by crafting malicious package names. The issue affects versions before 1.18.1.

The AWS API MCP Server (a tool that lets AI assistants interact with AWS services) has a security bug where if the security policy data fails to load when the server starts, the security checks are skipped for the entire time the server runs. This means users can perform AWS operations that should be blocked by the security policy, though AWS account permissions (IAM, the system that controls who can access what in AWS) still apply.

A vulnerability (CVE-2026-16796) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method that fails to properly validate package name inputs, allowing an authenticated attacker to run arbitrary commands (code execution) within the sandbox environment where Python packages are installed. This affects versions of bedrock-agentcore before 1.18.1.

The AWS API MCP Server (a tool that lets AI assistants run AWS commands on a user's account) has a security flaw where if the startup process fails to load its security policy rules, the server keeps running but stops checking those rules for the rest of its lifetime. This means an attacker could trick the startup into failing and then execute AWS operations that the policy was supposed to block. The underlying AWS account permissions still apply, but the policy-based restrictions are bypassed.

AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.

AWS HealthLake MCP Server (a tool that lets AI assistants access AWS health data) before version 0.0.14 has a security flaw where it doesn't check that pagination URLs (links used to load more results) point to the legitimate server. An authenticated attacker can exploit this by sending a crafted next_token parameter (a special value that tells the server what data to load next) to redirect requests to their own server and steal temporary AWS credentials (temporary access keys that grant permissions).

A vulnerability called CVE-2026-14471 exists in Amazon mcp-gateway-registry (a tool that manages AI agent access to different services) versions 1.0.3 through 1.0.12. An authenticated user can exploit SQL injection (inserting malicious SQL commands into inputs) in the metrics tracking system to read sensitive data like API keys, or delete and modify stored information.

A vulnerability (CVE-2026-12530) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method, which failed to properly block dangerous characters in package names before running them as shell commands. This allowed attackers to use flags like '--index-url' to redirect package downloads to fake servers or '-r' to read files from the sandbox system. Versions 1.1.3 through 1.6.0 are affected.

```json { "summary": "A vulnerability (CVE-2026-11393) exists in AWS AgentCore CLI, a tool for managing AI agents on Amazon Bedrock. An attacker with certain permissions could inject malicious Python code by exploiting improper escaping of triple-quote characters (""") in a specific field, allowing the attacker's code to run if the generated file is executed. The vulnerability affects versions 0.4.0 through 0.14.1 and certain preview versions.", "solution": "N/A -- no mitigation discussed in

Three security vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) were found in runc, a component used by container management systems (tools that package and run isolated software environments). AWS says these issues don't create cross-customer risk because AWS doesn't rely on containers as a security boundary (a protective barrier between different users). AWS customers using containers to isolate their own internal workloads should contact their operating system vendor for updates.

AWS discovered two security vulnerabilities in the SageMaker Python SDK (a library for machine learning on Amazon's platform). The first flaw exposes HMAC keys (cryptographic secrets that verify data hasn't been tampered with) through an API, allowing attackers to forge fake data in cloud storage. The second flaw disables SSL certificate verification (the security check that confirms you're connected to a legitimate server), affecting all encrypted connections when a certain model component is used.

Amazon Q Developer and AWS Kiro, which are AI tools that help developers write code, have security vulnerabilities related to prompt injection (tricking the AI by hiding malicious instructions in files or suggestions). Attackers could potentially execute commands or steal sensitive information without the developer's knowledge. AWS has released multiple software updates that require human confirmation before executing risky commands.

Amazon SageMaker Python SDK has a vulnerability where it stores an HMAC signing key (a cryptographic secret used to verify that model files haven't been tampered with) in plaintext as an environment variable that can be read by anyone with access to certain AWS APIs. An attacker with the right permissions could steal this key, use it to forge valid model files, and run malicious code on the system running the model.

A vulnerability in Amazon SageMaker Python SDK (a tool for building machine learning models on AWS) allows an attacker with write access to S3 (Amazon's cloud storage service) to execute malicious code by replacing model files with a specially crafted pickle file (a Python format for storing objects) that isn't checked for authenticity before being used. This only affects versions before v2.257.2 and v3.8.0, and requires the attacker to already have permission to write to the storage location.