Key points
- CVE-2026-12530 allows sandbox file exposure and arbitrary package sources via crafted arguments.
- The flaw affects AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0.
- AWS released version 1.6.1 to fix the improper neutralization of argument delimiters.
AWS resolved a vulnerability in the Bedrock AgentCore Python SDK that allowed bypassing sandbox restrictions. The flaw, tracked as CVE-2026-12530, let threat actors inject commands through package names, enabling file reading or malicious package installations within the Code Interpreter environment.
The issue stemmed from an incomplete blocklist in the install_packages() method. When constructing shell commands for pip installs, the SDK failed to properly sanitize arguments. This oversight permitted crafted strings to bypass validation, most notably allowing the --index-url flag to redirect resolution to attacker-controlled servers and the -r flag to expose arbitrary sandbox files.
Scope of the vulnerability
The vulnerability impacts AWS Bedrock AgentCore Python SDK versions 1.1.3 up to, but not including, version 1.6.1. According to the AWS Security Bulletins, the SDK is an open-source tool for building and managing agents on AWS Bedrock. The bulletin, published on 17 June 2026, classifies the issue as important and requiring attention.
Affected systems and remediation
Organisations using bedrock-agentcore versions between 1.1.3 and 1.6.0 are directly affected. AWS has addressed the issue in version 1.6.1. The vendor recommends upgrading to this latest version immediately. Teams using forked or derivative code must also apply the new fixes to ensure their implementations incorporate the necessary security improvements.
What happens next
Users unable to upgrade immediately should restrict calls to install_packages(). AWS advises against passing any user-supplied or externally-influenced strings directly to this method. Instead, applications should limit inputs to a fixed, hardcoded list of approved package names to prevent injection attempts until a patch is applied.
Why this attack works
This incident illustrates the risks of passing untrusted input to shell commands. When applications construct system commands using user data, incomplete sanitisation can allow attackers to inject additional arguments. This technique often serves to escalate privileges or exfiltrate data from isolated environments. Teams usually validate inputs against strict allowlists rather than blocklists to prevent such bypasses.
What to do and how to stay safe: AWS
- Upgrade AWS Bedrock AgentCore Python SDK to version 1.6.1 or later.
- Audit code for direct use of install_packages() with external inputs.
- Restrict package installation to a hardcoded list of approved names if patching is delayed.
- Monitor logs for unexpected pip commands or connections to unknown PyPI mirrors.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-12530?
It is a vulnerability in the AWS Bedrock AgentCore Python SDK where improper sanitisation of package names allows command injection.
Which versions are affected?
Versions 1.1.3 and above, but below version 1.6.1, are impacted by this issue.
Is there a fix available?
Yes, AWS released version 1.6.1 to address the vulnerability.
