CVE-2026-11393: Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

Synopsis

Code injection via improper triple-quote escaping affects AgentCore CLI (versions up to 0.14.1 and up to 1.0.0-preview.8). An authenticated attacker who can craft a malicious collaborationInstruction on a Bedrock Agent collaborator can inject arbitrary Python code that executes when another user in the same AWS account imports that agent using the CLI, requiring both network access and victim interaction. Successful exploitation gives the attacker arbitrary code execution inside AWS AgentCore Runtime under the imported agent's IAM role, as well as on the local machine of the user who triggered the import. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target AWS account's Bedrock Agent service over the network to plant the malicious collaborationInstruction.

• AuthenticationRequired

  Any low-privilege AWS account credential is sufficient; the attacker must be an authenticated user capable of writing a collaborationInstruction to a Bedrock Agent collaborator.

• Victim interactionRequired

  A second user in the same AWS account must actively run an agent import operation using AgentCore CLI against the poisoned collaborator, making this a social-engineering or supply-chain vector.

• Attack complexityDetail

  The CVSS vector notes an attack target prerequisite (AT:P), meaning certain environmental conditions around the shared AWS account and the import workflow must be in place, though the exploit itself is otherwise straightforward once those conditions exist.

Blast Radius

• Executes arbitrary Python code inside AWS AgentCore Runtime under the imported agent's IAM execution role, granting the attacker whatever AWS permissions that role holds.
• Executes arbitrary code on the local machine of the victim user who triggered the import operation.
• Reads, modifies, or deletes AWS resources accessible to the agent's IAM role, depending on the role's attached policies.
• Compromises downstream systems or data reachable from the victim's local environment at the time of import.