CVE-2026-11393: AgentCore CLI RCE Vulnerability

CVE-2026-11393 Overview

CVE-2026-11393 is a code injection vulnerability in AWS AgentCore CLI versions prior to v0.14.2. The flaw stems from improper neutralization of triple-quote characters during Python code generation [CWE-94]. An authenticated remote attacker can store a crafted collaborationInstruction on a Bedrock Agent collaborator. When another user in the same AWS account imports that agent, the malicious payload executes arbitrary Python code under the imported agent's IAM execution role on AWS AgentCore Runtime and on the victim's local environment.

Critical Impact
Successful exploitation grants arbitrary code execution under another user's AWS IAM execution role and on their local machine, enabling cross-tenant compromise within a shared AWS account.

Affected Products

AWS AgentCore CLI versions before v0.14.2
NPM package @aws/agentcore prior to v0.14.2
AWS Bedrock Agent collaborator import workflows using the affected CLI

Discovery Timeline

2026-06-08 - CVE-2026-11393 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11393

Vulnerability Analysis

The AgentCore CLI generates Python source files from Bedrock Agent metadata during the agent import process. The collaborationInstruction field on a Bedrock Agent collaborator is embedded into generated Python code as a triple-quoted string literal. The CLI does not sanitize or escape triple-quote sequences (""" or ''') within attacker-controlled values.

An attacker who can write to a Bedrock Agent collaborator can break out of the string literal and append arbitrary Python statements. When another user imports the agent, the generated Python is executed on the AgentCore Runtime under the imported agent's IAM execution role. The same generated code also runs in the local environment of the importing user.

Root Cause

The root cause is missing neutralization of string-delimiter characters during dynamic code generation. The CLI treats remote, attacker-influenced text as trusted content when constructing Python source. Triple-quote characters in the input close the surrounding string literal and allow injected statements to be parsed and executed as code.

Attack Vector

Exploitation requires the attacker to be authenticated to AWS and to have write access to a Bedrock Agent collaborator's collaborationInstruction field. The attacker injects triple-quote sequences followed by Python statements into that field. When a second user in the same AWS account imports the affected agent through the vulnerable AgentCore CLI, the generated import script executes the attacker's payload. The payload runs both locally on the importing user's workstation and remotely on AgentCore Runtime with the imported agent's IAM permissions, enabling lateral movement and credential theft within the AWS account.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-m4x6-gwgp-4pm7 for vendor technical details.

Detection Methods for CVE-2026-11393

Indicators of Compromise

Bedrock Agent collaborator records whose collaborationInstruction field contains triple-quote characters (""" or '''), Python keywords such as import, exec, eval, __import__, or shell metacharacters
Unexpected outbound network connections originating from AgentCore Runtime sessions shortly after an agent import operation
AWS CloudTrail sts:AssumeRole or iam:* events made by the imported agent's IAM execution role outside its normal operational pattern
Local Python processes spawned by the AgentCore CLI that execute child processes or write files outside the CLI's expected working directory

Detection Strategies

Inspect all Bedrock Agent collaborator records in the account for triple-quote sequences or suspicious Python tokens within collaborationInstruction values
Correlate bedrock:GetAgent and bedrock:GetAgentCollaborator API calls in CloudTrail with subsequent process activity on developer workstations
Alert on AgentCore Runtime execution role activity that deviates from baseline behavior, such as new API calls or new resource access

Monitoring Recommendations

Enable CloudTrail data events for Bedrock Agent and AgentCore Runtime services and forward them to a centralized log store
Monitor developer endpoints for Python interpreter invocations spawned by the AgentCore CLI binary and flag deviations from known import behavior
Track the version of @aws/agentcore installed across developer workstations and CI/CD runners to confirm patch deployment

How to Mitigate CVE-2026-11393

Immediate Actions Required

Upgrade AgentCore CLI to v0.14.2 or later, or to 1.0.0-preview.9, on every workstation and pipeline that performs agent imports
Audit existing Bedrock Agent collaborators for malicious collaborationInstruction values before performing any further imports
Apply least-privilege IAM policies to agent execution roles so that exploitation impact is contained
Restrict write access to Bedrock Agent collaborators to a minimal set of trusted principals

Patch Information

AWS resolved this issue in AgentCore CLI v0.14.2. Users should upgrade through the GitHub Release v0.14.2 or install the patched NPM package @aws/agentcore v0.14.2. Preview track users should move to NPM Package @aws/agentcore v1.0.0-preview.9. Refer to the AWS Security Bulletin 2026-040 for the official advisory.

Workarounds

Do not import Bedrock Agents authored by other principals until the CLI is upgraded
Manually review the collaborationInstruction field of every collaborator on an agent before importing it
Run the AgentCore CLI inside an ephemeral, network-restricted container that uses a scoped-down IAM role to limit blast radius

bash

# Upgrade the AgentCore CLI to the patched version
npm install -g @aws/agentcore@0.14.2

# Verify the installed version
agentcore --version