CVE-2026-18830

Published Aug 4, 2026·Updated Aug 6, 2026

NVD Description

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

Public Exploits & PoCs1 found

PoC: aegisagent

AegisAgent - Runtime security gateway & privilege governance for AI agents. Cryptographic tool-call provenance (CoreBreak/CVE-2026-18830/18236/64650 defense), policy engine, sandbox isolation, HITL approval, MCP security proxy, tamper-evident audit.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free