CVE-2026-4269

High

Published: 16 March 2026

Published

16 March 2026

Modified

17 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0006 17.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4269 is a high-severity Unverified Ownership (CWE-283) vulnerability in Amazon (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-7 (Software, Firmware, and Information Integrity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SR-11 Component Authenticity good match

prevent

Verifies authenticity and ownership of S3 objects pulled during the Bedrock AgentCore Starter Toolkit build process, directly preventing code injection from unverified sources.

SI-7 Software, Firmware, and Information Integrity good match

prevent

Enforces integrity verification of software and components in the AgentCore Runtime, blocking execution of code injected via the unverified S3 flaw.

SI-2 Flaw Remediation good match

prevent

Requires timely flaw remediation through upgrading to Bedrock AgentCore Starter Toolkit v0.1.13, eliminating the missing S3 ownership verification vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Missing S3 ownership verification enables code injection into the build process of a client-side toolkit, directly facilitating exploitation for client execution (T1203) that results in arbitrary code execution (T1059) within the runtime.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of…

the Bedrock AgentCore Starter Toolkit before version v0.1.13 who build or have built the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users on previous versions who built the toolkit before September 24, 2025 are not affected. To remediate this issue, customers should upgrade to version v0.1.13.

Deeper analysisAI

CVE-2026-4269 stems from a missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit prior to version v0.1.13. This flaw affects only users who build or have built the toolkit after September 24, 2025; those on version v0.1.13 or later, or who built earlier versions before that date, remain unaffected. The vulnerability enables code injection during the build process, resulting in arbitrary code execution within the AgentCore Runtime, and is associated with CWE-283 (Unverified Ownership) and CWE-340 (Generation of Predictable Numbers or Identifiers).

A remote attacker can exploit this over the network without privileges, though it demands high attack complexity and user interaction, per its CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). By compromising the S3 verification step, the attacker injects malicious code into the build, achieving full code execution in the runtime environment with high impacts on confidentiality, integrity, and availability.

AWS advisories recommend upgrading to Bedrock AgentCore Starter Toolkit v0.1.13 as the sole remediation. Details are available in the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-008-AWS/ and the GitHub release notes at https://github.com/aws/bedrock-agentcore-starter-toolkit/releases/tag/v0.1.13.