CVE-2026-11393
Summary
The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the agentcore add agent --type import command, resulting in arbitrary code execution when the generated file is loaded or deployed.
Impact
When a user runs agentcore add agent --type import to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python statements into the generated source file.
An authenticated AWS user in the same account with the bedrock:AssociateAgentCollaborator IAM permission can associate a collaborator agent carrying a crafted collaborationInstruction with a supervisor agent. A developer who subsequently imports that supervisor agent using an affected CLI version will have the injected code written to their local main.py of the imported agent. The injected code executes in two contexts: on the developer's local machine when running agentcore dev, under the developer's local AWS credentials; and in the AWS AgentCore Runtime environment when the developer runs agentcore deploy followed by agentcore invoke, under the agent's IAM execution role.
Customers who have already imported a supervisor agent using an affected version and deployed it to AWS remain exposed on every agent invocation until they regenerate and redeploy the agent using a patched CLI version.
Impacted versions: @aws/agentcore >= 0.4.0 AND <= 0.14.1, pre
CSIRTS triage
- What
- Improper neutralization of triple-quote characters may allow an authenticated user to inject arbitrary Python code.
- Who is affected
- Authenticated users in the same AWS account with bedrock:AssociateAgentCollaborator IAM permission.
- Urgency
- Remediation is important as it allows code injection, but exploitation has not been confirmed.
- Action
- Review and patch the AgentCore CLI to mitigate this vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-11393
Get an email if CVE-2026-11393 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-11393)