CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Bulletin ID: 2026-065-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/23/2026 13:00 PM PDT

The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. We identified CVE-2026-16796, an improper neutralization of argument delimiters in the install_packages() method that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

Impacted versions: bedrock-agentcore version <1.18.1

This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules, including constraining any extras group to comma-separated identifiers, before calling the SDK.

We would like to thank Sergio Garcia and BeyondTrust Phantom Labs for collaborating on this issue through the coordinated issue disclosure process.