CVE-2026-4269 - Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
Bulletin ID: 2026-008-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/16 11:15 AM PDT Description: A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. Impacted versions: All versions of Bedrock AgentCore Starter Toolkit versions before v0.1.13. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who build the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users on previous versions who built the toolkit before September 24, 2025 are not affected. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CSIRTS triage
- What
- Missing S3 ownership verification may allow a remote actor to inject code during the build process.
- Who is affected
- Users of Bedrock AgentCore Starter Toolkit versions before v0.1.13 who build the Toolkit after September 24, 2025.
- Urgency
- Remediation is critical to prevent code injection during the build process.
- Action
- Upgrade to Bedrock AgentCore Starter Toolkit version v0.1.13 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Bedrock AgentCore Starter Toolkit
Get an email when a new Bedrock AgentCore Starter Toolkit advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-008-aws/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-42690.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-4269 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for - Improper S3
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalGHSA-xwwr-4h3p-r22c: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signat…ghsa · 2026-09-10
- highGHSA-2p48-j3qc-rx9f: rclone: S3 multipart declared-length memory exhaustionghsa · 2026-09-10
- highCVE-2026-88045: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-09-10
- criticalCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-09-10
- mediumCVE-2026-87913: A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 v…nvd · 2026-09-10
- mediumCVE-2026-87912: A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agen…nvd · 2026-09-10
More from AWS Security Bulletins
- unknownCVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration2026-09-11
- unknownCVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v22026-09-11
- unknownCVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin2026-09-11
- unknownCVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection2026-09-11
- unknownCVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Syste…2026-09-10