CVE-2026-106032

Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

State: Published
Severity: 5.7 Medium
Published: Oct 6, 2026
Updated: Oct 7, 2026
Reserved: Oct 6, 2026

Read the record on cve.org

Description

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files, via crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group.

To remediate this issue, users should upgrade to version 0.3.14. Note that bedrock-agentcore-starter-toolkit is deprecated. The @aws/agentcore npm CLI is the supported replacement and does not contain this issue. Migration to @aws/agentcore is the recommended long-term path.

Scores

CVSS	Score	Vector	Source
4.0	5.7 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	AMZN
3.1	5.7 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	AMZN

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF),CWE-73: External Control of File Name or Path

Affected Products

Product	Versions
bedrock-agentcore-starter-toolkitaws	0.1.4 through 0.3.13Affected

References

https://pypi.org/project/bedrock-agentcore-starter-toolkit/0.3.14/patchrelease-notes
https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-127-aws/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.