This vulnerability (CVE-2026-4269) affects AWS Bedrock AgentCore Starter Toolkit versions prior to v0.1.13. It involves a missing verification step for S3 ownership during the build process, which can be exploited by a remote attacker to inject malicious code. Successful exploitation could lead to arbitrary code execution within the AgentCore Runtime environment. The vulnerability is classified under CWE-340 (Generation of Predictable Numbers or Identifiers) and CWE-283 (Authentication Issues). The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The issue is resolved by upgrading to version v0.1.13 or later.

If exploited, this vulnerability allows remote attackers to inject code during the build process of the toolkit, leading to arbitrary code execution in the AgentCore Runtime. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability affects users who built the toolkit after September 24, 2025 using vulnerable versions. There are no known exploits in the wild at this time.

Upgrade the AWS Bedrock AgentCore Starter Toolkit to version v0.1.13 or later. This version includes the necessary S3 ownership verification during the build process to prevent code injection. Users who built the toolkit on vulnerable versions after September 24, 2025 should rebuild using the patched version. No other mitigations are specified.