AWS Bedrock AgentCore 1.6.1 fixes CVE-2026-12530 sandbox file exposure from crafted package names
Version 1.6.1 addresses CVE-2026-12530, which allowed crafted package names to bypass validation and expose sandbox files.
Key points
- AWS released version 1.6.1 of the Bedrock AgentCore Python SDK to fix CVE-2026-12530.
- Vulnerable versions range from 1.1.3 up to, but not including, 1.6.1.
- The flaw allowed attackers to redirect package resolution or read arbitrary files within the Code Interpreter sandbox.
AWS has released version 1.6.1 of the Bedrock AgentCore Python SDK to address a vulnerability in its Code Interpreter client. The update fixes CVE-2026-12530, a flaw that allowed improperly neutralized argument delimiters to bypass security controls. Organizations using affected versions can now apply a confirmed patch to resolve the issue.
How it unfolded
- AWS published security bulletin 2026-044-AWS on June 17, 2026, detailing the vulnerability in the open-source SDK.
- The advisory identified that the install_packages() method used an incomplete blocklist to sanitize package name arguments.
- This weakness allowed crafted inputs to inject flags such as --index-url or -r into the underlying pip install command.
Who is affected
The vulnerability impacts AWS Bedrock AgentCore Python SDK versions greater than or equal to 1.1.3 and less than 1.6.1. The issue resides specifically within the Code Interpreter client component. Developers who have forked or created derivative code from these versions must also incorporate the new fixes. AWS stated that the flaw could allow redirection of package resolution to third-party servers or exposure of sandbox files.
Our take on the response
AWS provided a clear remediation path by releasing version 1.6.1 and offering specific mitigation steps for those unable to upgrade immediately. The company credited Sergio Garcia for collaborating through the coordinated vulnerability disclosure process. The advisory explicitly warns against passing user-supplied strings to the vulnerable method, highlighting the importance of input validation in sandboxed environments.
Who needs to act first
Teams managing AWS Bedrock AgentCore deployments should prioritize updating systems that process external or user-supplied package names. Check inventory records to identify instances running versions between 1.1.3 and 1.6.0. Before rolling out the update, test the new SDK version in a staging environment to ensure compatibility with existing agent workflows. If immediate patching is not feasible, restrict the install_packages method to hardcoded lists of approved packages to limit exposure.
What to do and how to stay safe: AWS
- Upgrade the AWS Bedrock AgentCore Python SDK to version 1.6.1 or later on all affected systems.
- Review application code to ensure no user-supplied strings are passed directly to the install_packages method.
- Restrict package installation calls to a fixed, hardcoded list of approved package names if upgrading is delayed.
- Monitor Code Interpreter sandbox logs for any unexpected package resolution redirects or file access attempts.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific versions of the Bedrock AgentCore SDK are vulnerable?
Versions greater than or equal to 1.1.3 and less than 1.6.1 are affected by CVE-2026-12530.
Is there a confirmed fix for this vulnerability?
Yes, AWS has addressed the issue in version 1.6.1 of the Bedrock AgentCore Python SDK.
What can the vulnerability allow an attacker to do?
It allows crafted package names to bypass validation, potentially redirecting package resolution or exposing arbitrary sandbox files.
