CVE-2026-16796: bedrock-agentcore argument injection

Q: Is CVE-2026-16796 actively exploited?

No confirmed active exploitation of CVE-2026-16796 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-16796?

1) Upgrade bedrock-agentcore to version 1.18.1 or later immediately -- this is the primary fix. 2) If upgrading isn't immediately possible, never pass untrusted or model-generated input directly to install_packages(); validate any dynamic package name against strict PyPI naming rules, including constraining extras groups to comma-separated identifiers. 3) Audit any forked or derivative copies of the SDK to confirm they incorporate the same input-validation fix. 4) Add monitoring for anomalous subprocess execution, unexpected outbound network calls, or filesystem access originating from Code Interpreter sandbox containers as a compensating detection control.

Q: What systems are affected by CVE-2026-16796?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution, cloud AI agent platforms.

Q: What is the CVSS score for CVE-2026-16796?

CVE-2026-16796 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.73%.

CISO Take

AWS's Bedrock AgentCore Python SDK, used to build AI agents with code-execution capabilities, contains an argument-injection flaw (CWE-88) in its install_packages() method that lets a crafted package specifier break out of the intended pip install command and run arbitrary commands inside the managed Code Interpreter sandbox. Exploitation requires an authenticated user (PR:L) and some user interaction (UI:R), and while EPSS puts exploitation probability at just 0.33% with no public PoC, Nuclei template, or CISA KEV listing today, the flaw sits squarely in the emerging agentic-AI attack surface: any application that feeds dynamic or model-generated package names into install_packages() -- a common pattern for data-science or coding agents -- is a viable trigger path, turning routine tool use into sandbox command execution with high confidentiality and integrity impact. AWS shipped the fix in bedrock-agentcore 1.18.1; teams should upgrade immediately, and until then must never pass untrusted or model-generated input to install_packages(), instead validating package specifiers against strict PyPI naming rules and constraining any extras group to comma-separated identifiers. Detection should focus on anomalous process execution or unexpected network/filesystem activity originating from Code Interpreter sandbox containers.

Sources: NVD GitHub Advisory EPSS ATLAS aws.amazon.com

What is the risk?

CVSS 3.1 base score of 7.3 (High) with C:H/I:H/A:N reflects a serious confidentiality and integrity impact once triggered, but the attack requires an authenticated user and some user interaction, which caps ambient risk. There is no evidence of active exploitation: no CISA KEV listing, no public exploit code, no Nuclei template, and EPSS scores this at 0.33% likelihood of near-term exploitation. Net assessment: moderate-to-high risk specifically for organizations running production AI agents on Bedrock AgentCore that allow any form of dynamic or model-influenced package installation -- this class of argument-injection bug is straightforward to weaponize once the technique is understood, so the low current EPSS score should not be read as low urgency to patch.

How does the attack unfold?

Tool invocation

An authenticated user (or the LLM acting on their behalf) invokes the agent's Code Interpreter tool with a package name to be installed via install_packages().

AML.T0053

Argument injection

A crafted package specifier with unescaped delimiters and a bogus extras group bypasses install_packages()'s input validation.

Command execution

The injected arguments are passed to the underlying pip/command interpreter, causing arbitrary command execution instead of a normal package install.

AML.T0050

Sandbox impact

The attacker gains read/write access within the Code Interpreter sandbox, exposing sandbox data, code, or credentials with high confidentiality and integrity impact.

Tool invocation

An authenticated user (or the LLM acting on their behalf) invokes the agent's Code Interpreter tool with a package name to be installed via install_packages().

AML.T0053

Argument injection

A crafted package specifier with unescaped delimiters and a bogus extras group bypasses install_packages()'s input validation.

Command execution

The injected arguments are passed to the underlying pip/command interpreter, causing arbitrary command execution instead of a normal package install.

AML.T0050

Sandbox impact

The attacker gains read/write access within the Code Interpreter sandbox, exposing sandbox data, code, or credentials with high confidentiality and integrity impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
bedrock-agentcore	pip	< 1.18.1	`1.18.1`

Do you use bedrock-agentcore? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade bedrock-agentcore to version 1.18.1 or later immediately -- this is the primary fix. 2) If upgrading isn't immediately possible, never pass untrusted or model-generated input directly to install_packages(); validate any dynamic package name against strict PyPI naming rules, including constraining extras groups to comma-separated identifiers. 3) Audit any forked or derivative copies of the SDK to confirm they incorporate the same input-validation fix. 4) Add monitoring for anomalous subprocess execution, unexpected outbound network calls, or filesystem access originating from Code Interpreter sandbox containers as a compensating detection control.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MAP 4.1 - Risks and benefits of third-party AI components are mapped

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-16796?

AWS's Bedrock AgentCore Python SDK, used to build AI agents with code-execution capabilities, contains an argument-injection flaw (CWE-88) in its install_packages() method that lets a crafted package specifier break out of the intended pip install command and run arbitrary commands inside the managed Code Interpreter sandbox. Exploitation requires an authenticated user (PR:L) and some user interaction (UI:R), and while EPSS puts exploitation probability at just 0.33% with no public PoC, Nuclei template, or CISA KEV listing today, the flaw sits squarely in the emerging agentic-AI attack surface: any application that feeds dynamic or model-generated package names into install_packages() -- a common pattern for data-science or coding agents -- is a viable trigger path, turning routine tool use into sandbox command execution with high confidentiality and integrity impact. AWS shipped the fix in bedrock-agentcore 1.18.1; teams should upgrade immediately, and until then must never pass untrusted or model-generated input to install_packages(), instead validating package specifiers against strict PyPI naming rules and constraining any extras group to comma-separated identifiers. Detection should focus on anomalous process execution or unexpected network/filesystem activity originating from Code Interpreter sandbox containers.

Is CVE-2026-16796 actively exploited?

No confirmed active exploitation of CVE-2026-16796 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-16796?

1) Upgrade bedrock-agentcore to version 1.18.1 or later immediately -- this is the primary fix. 2) If upgrading isn't immediately possible, never pass untrusted or model-generated input directly to install_packages(); validate any dynamic package name against strict PyPI naming rules, including constraining extras groups to comma-separated identifiers. 3) Audit any forked or derivative copies of the SDK to confirm they incorporate the same input-validation fix. 4) Add monitoring for anomalous subprocess execution, unexpected outbound network calls, or filesystem access originating from Code Interpreter sandbox containers as a compensating detection control.

What systems are affected by CVE-2026-16796?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution, cloud AI agent platforms.

What is the CVSS score for CVE-2026-16796?

CVE-2026-16796 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.73%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed code executioncloud AI agent platforms

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MAP 4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

### Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the install_packages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. ### Impact Insufficient input validation in install_packages() allows specially crafted package specifiers to bypass validation and achieve arbitrary command execution within the sandbox. A remote authenticated user who can influence the arguments to install_packages() can execute arbitrary commands within the Code Interpreter sandbox environment. ### Impacted Versions < 1.18.1 ### Patches This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. ### Workarounds If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers -- before calling the SDK. ### References If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. ### Acknowledgement AWS would like to thank Sergio Garcia (@MrCloudSec) for collaborating on this issue through the coordinated issue disclosure process.

Exploitation Scenario

An organization deploys an AI coding/data-analysis agent on AWS Bedrock AgentCore that lets its LLM decide which Python packages to install in the Code Interpreter sandbox to complete a user's task -- a common agentic pattern. An authenticated user of the application submits a request crafted so the LLM (or the user directly, where package names are user-influenced) produces a package specifier containing unescaped argument delimiters and a bogus extras group. install_packages() fails to reject this crafted input, and the underlying pip invocation executes the injected arguments as arbitrary commands inside the sandbox rather than simply installing a package. The attacker now has command execution within the sandbox, letting them read sandbox files, exfiltrate any sensitive data or credentials the agent has access to, or use the foothold to probe further within the AI application's runtime.

Weaknesses (CWE)

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Primary

CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.