# CVE-2026-78379: Amazon Strands Agents Tools python_repl consent bypass

Source: https://junglewise.ai/threats/cve-2026-78379-amazon-strands-agents-tools-python-repl-consent-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78379 · Severity: high · CVSS 8.1 · Published 2026-08-25

Amazon Strands Agents is an SDK for building and running AI agents, which includes tools that execute code on behalf of the operator. The python_repl tool normally requires human approval before running Python code to prevent misuse. A consent bypass vulnerability allows remote attackers to skip this approval gate by crafting a malicious prompt that passes parameters through the batch tool, leading to arbitrary code execution on the agent's host.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [Amazon Strands-Agents-Tools](https://junglewise.ai/threats/technologies/strands-agents-tools). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon).

## Quick answers

**Is CVE-2026-78379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78379 being exploited in the wild.

**How severe is CVE-2026-78379?** High severity, with a CVSS score of 8.1, published 25 August 2026.

**Which products and versions are affected?** Amazon Strands-Agents-Tools < 0.8.5.

**Is there a fix for CVE-2026-78379?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78379 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78379?** Check whether you run Amazon AWS or Amazon Strands-Agents-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-78379 is a prompt injection / consent bypass vulnerability in the python_repl tool within Amazon Strands Agents Tools. The root cause is improper neutralization of input used for LLM prompting, allowing an attacker to forge a crafted prompt that passes the non_interactive_mode keyword argument through the batch tool to bypass the human consent gate. The attack is network-accessible if the agent is exposed to remote input and requires no authentication or user interaction beyond the agent processing the malicious prompt. An attacker can execute arbitrary Python code on the agent's host by bypassing the intended approval mechanism. The vulnerability affects versions before 0.8.5, and a patch is available in 0.8.5 or later.

## Affected products

- Amazon Strands Agents Tools < 0.8.5

## Timeline

- 2026-08-25: disclosed
- 2026-09-09: advisory

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-089-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-089-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)