CVE-2026-18830 HIGH

CVE-2026-18830: Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Vendor Aws
Product Amazon Bedrock AgentCore harness
Weakness CWE-1287
Published August 4, 2026
Last update August 4, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

Key dates

02Disclosure timeline

August 4, 2026 CVE published