Loading vulnerability…
Amazon Bedrock AgentCore InvokeHarness Tool-Execution Authorization Bypass
CVE-2026-18830 is an insufficient input-validation vulnerability in the Amazon Bedrock AgentCore harness InvokeHarness API. Before AWS's server-side remediation, an authenticated caller could submit a conversation whose most recent message contained a crafted tool-use content block. The harness event loop could treat this caller-supplied block as an authorized tool invocation and dispatch the named configured tool directly, without a model invocation or enforcement of the security controls associated with model-mediated tool selection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated remote attacker could execute tools configured on a targeted AgentCore harness while bypassing intended model mediation and associated security controls. The resulting confidentiality and integrity impact depends on the capabilities, permissions, and accessible data of the configured tools. Harnesses without configured tools are not materially exploitable through this path. Availability impact is not identified.
If you can’t patch tonight, do this now.
No customer workaround is required for the AWS-managed service because the server-side mitigation is already deployed. Organizations should nevertheless apply least privilege to tool configurations and limit tool access to only necessary data and operations to reduce the impact of any tool-authorization failure.
Patch, then assume compromise.
AWS remediated the AWS-managed InvokeHarness service by implementing server-side validation that rejects caller-supplied tool-use content blocks in the final message before they reach the agent event loop. The remediation was applied automatically; no customer action is required for the managed service.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.