CVE-2026-18830CWE-1287

CVE-2026-18830

High · published August 4, 2026

CVSS v3.1

8.1

EPSS

Percentile

42.4

In the wild

Unconfirmed

What it is

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00507 · 42.4th percentile
Weakness: CWE-1287 · Improper Validation of Specified Type of Input
Published: 2026-08-04T22:16Z

References (1)

https://aws.amazon.com/security/security-bulletins/2026-073-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5

EPSS history

Timeline

04 AUG 17:42Z
Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
cvelistv5