CVE-2026-16796: AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the install_packages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
References
- aws.amazon.com/security/security-bulletins/2026-065-aws
- github.com/advisories/GHSA-j6g5-3hh3-pgw8
- github.com/aws/bedrock-agentcore-sdk-python/commit/3c4b4ee6b8730e6313a82c743ac37dbcc1c21cdb
- github.com/aws/bedrock-agentcore-sdk-python/pull/581
- github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8
- nvd.nist.gov/vuln/detail/CVE-2026-16796
- pypi.org/project/bedrock-agentcore/1.18.1
Code Behaviors & Features
Detect and mitigate CVE-2026-16796 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →