CVE-2026-106032: CWE-918: Server-Side Request Forgery (SSRF),CWE-73: External Control of File Name or Path in aws bedrock-agentcore-starter-toolkit

This vulnerability involves SSRF and external control of file name or path in the OpenAPI schema processing during agent import in Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14. An authenticated user with permissions in the same AWS account can craft external reference values in the OpenAPI content associated with a Bedrock Agent action group to trigger arbitrary outbound network requests and local file reads in the importing user's environment. The flaw is addressed by upgrading to version 0.3.14. Since the toolkit is deprecated, migration to the @aws/agentcore npm CLI is advised as a long-term solution.

An authenticated actor within the same AWS account can exploit this vulnerability to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound network requests and read arbitrary local files. This can lead to unauthorized data disclosure and potential interaction with unintended external systems. The CVSS 4.0 base score is 5.7 (medium severity), reflecting the need for authentication and limited scope to the same AWS account.

A fix is available by upgrading to version 0.3.14 of the bedrock-agentcore-starter-toolkit. Additionally, since this toolkit is deprecated, users should migrate to the supported @aws/agentcore npm CLI, which does not contain this vulnerability. This migration is the recommended long-term remediation path.