CVE-2026-18830: Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-10-24
Weakness: CWE-1287

Description

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

Affected products

AWS Amazon Bedrock AgentCore harness: all versions

References

https://aws.amazon.com/security/security-bulletins/2026-073-aws/

Get alerted when CVE-2026-18830 or the next vulnerability affects your stack