CVE-2026-18830 — Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

CVE-2026-18830

Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API PUBLISHED

Description (CNA)

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

Affected (CNA)

Vendor / product	Versions
AWS / Amazon Bedrock AgentCore harness	affected N/A

CWE

CWE-1287

References

https://aws.amazon.com/security/security-bulletins/2026-073-aws/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.