Vulnerabilities
AWS Bedrock AgentCore 1.6.1 fixes CVE-2026-12530 sandbox file exposure from crafted package names
Version 1.6.1 addresses CVE-2026-12530, which allowed crafted package names to bypass validation and expose sandbox files.
AWS
Everything Patch Observer has reported about AWS: 4 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
AWS API MCP Server Startup Error Bypasses Security Policies Until Restart; Upgrade to 1.3.47
A startup error in the AWS API MCP Server bypasses security policies until the process restarts, requiring an immediate upgrade to version 1.3.47.
Vulnerabilities
Orgs urged to patch AWS Smithy-RS 0.66.5 to block unauthenticated Slowloris DoS in Rust servers
An unauthenticated denial-of-service vulnerability in AWS Smithy-RS affects versions through 0.66.4, with a fix available in version 0.66.5.
Cloud Security
Teams block prod if AI confirms vulns in specific code changes via AWS Continuum CI/CD
AWS Continuum uses AI agents to confirm exploitable vulnerabilities in deployed changes, allowing teams to block production promotion based on severity thresholds.