Amazon patches AgentCore flaws exposing AWS credentials
Amazon Web Services has patched two high-severity vulnerabilities in the Python software development kit for Amazon Bedrock AgentCore that could allow attackers to execute arbitrary commands inside Code Interpreter sandboxes and obtain temporary AWS credentials attached to customer execution roles. The flaws, tracked as CVE-2026-12530 and CVE-2026-16796, affected the SDK’s install_packages()…
Amazon Web Services (AWS) has recently addressed two high-severity vulnerabilities in the Python software development kit (SDK) for Amazon Bedrock AgentCore. These flaws, identified as CVE-2026-12530 and CVE-2026-16796, could enable attackers to execute arbitrary commands within Code Interpreter sandboxes and obtain temporary AWS credentials linked to customer execution roles. The severity of CVE-2026-12530 led AWS to classify it as high.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
