What is 2026-065-AWS?

2026-065-AWS is a security advisory published by AWS Security Bulletins with High severity. CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Which CVE IDs does 2026-065-AWS cover?

2026-065-AWS covers the following CVE IDs: CVE-2026-16796. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-065-AWSHigh

CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Vendor

AWS Security Bulletins

Published

July 23, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-16796 →

📋 Description

Bulletin ID: 2026-065-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 13:00 PM PDT Description: The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. We identified CVE-2026-16796, an improper neutralization of argument delimiters in the install_packages() method that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. Impacted versions: bedrock-agentcore version
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-065-aws/