Is CVE-2026-4269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4269 being exploited in the wild.

How severe is CVE-2026-4269?

High severity, with a CVSS score of 7.5, published 16 March 2026.

Which products and versions are affected?

bedrock-agentcore-starter-toolkit (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.13.

Is there a fix for CVE-2026-4269?

Yes. bedrock-agentcore-starter-toolkit (PyPI): upgrade to 0.1.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4269 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4269?

Check whether you run Amazon AWS, Amazon Bedrock Agentcore Starter Toolkit or bedrock-agentcore-starter-toolkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4269: AWS Bedrock AgentCore Starter Toolkit code injection via S3 ownership bypass

CVE-2026-4269 · Severity: high · CVSS 7.5 · Published 2026-03-16

The Bedrock AgentCore Starter Toolkit, a tool used to build and deploy AI agents on AWS, contains a security flaw in how it verifies data storage locations. An attacker could potentially inject malicious code during the software build process, leading to unauthorized code execution within the agent's runtime environment. This could allow an attacker to compromise the AI agent's operations or access sensitive data processed by the toolkit.

Technologies: Amazon AWS, Amazon Bedrock Agentcore Starter Toolkit. Vendors: Amazon, PyPI.

Quick answers

Is CVE-2026-4269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4269 being exploited in the wild.
How severe is CVE-2026-4269?: High severity, with a CVSS score of 7.5, published 16 March 2026.
Which products and versions are affected?: bedrock-agentcore-starter-toolkit (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.13.
Is there a fix for CVE-2026-4269?: Yes. bedrock-agentcore-starter-toolkit (PyPI): upgrade to 0.1.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4269 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4269?: Check whether you run Amazon AWS, Amazon Bedrock Agentcore Starter Toolkit or bedrock-agentcore-starter-toolkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bedrock-agentcore-starter-toolkit (PyPI): upgrade to 0.1.13 or later
```
pip install "bedrock-agentcore-starter-toolkit>=0.1.13"
```

Technical details

The vulnerability is caused by improper S3 bucket ownership verification within the Bedrock AgentCore Starter Toolkit's build process. Because the toolkit fails to confirm that the S3 bucket used during the build is owned by the expected account, a remote attacker could potentially supply malicious artifacts. This supply-chain style attack allows for code injection that persists into the AgentCore Runtime environment. The issue specifically impacts builds performed after September 24, 2025, using toolkit versions prior to v0.1.13. Users are advised to upgrade to version v0.1.13 or later to remediate the flaw.

Affected products

AWS Bedrock AgentCore Starter Toolkit < v0.1.13

Identifiers

CVE-2026-4269
GHSA-xfhr-q72q-jcrj
PYSEC-2026-2396

Timeline

2026-03-16: advisory: AWS published security bulletin 2026-008-AWS
2026-03-16: disclosed: CVE-2026-4269 was publicly disclosed

References

https://aws.amazon.com/security/security-bulletins/rss/2026-008-aws/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.