Summary
CVE-2026-11393 describes a critical (CVSS 9) remote code execution vulnerability affecting AgentCore CLI versions prior to v0.14.2, published on June 8, 2026. This flaw stems from improper neutralization of triple-quote characters during Python code generation. An authenticated remote threat actor can leverage this to execute arbitrary code on the AWS AgentCore Runtime, operating under the imported agent’s IAM execution role, and also on the local environment of another user within the same AWS account.
The Bug
The core issue lies in the AgentCore CLI’s handling of triple-quote characters when generating Python code. Specifically, the vulnerability manifests when processing a collaborationInstruction stored on a Bedrock Agent collaborator. If this instruction contains specially crafted triple-quote characters, the CLI fails to neutralize them properly during Python code generation. This bypass allows an attacker to break out of intended code structures and inject arbitrary Python code.
The exact injection point within the collaborationInstruction isn’t specified in the advisory, but it’s clearly tied to the Python code generation process. Researchers should focus on how the CLI parses and incorporates external data into executable Python scripts.
Attack Requirements
Exploiting CVE-2026-11393 requires an authenticated remote threat actor. The vulnerability impacts AgentCore CLI installations before version 0.14.2. The attack vector is network-based, as indicated by the “remote threat actor” description, allowing exploitation over the network.
Exploitation
An authenticated remote threat actor initiates the attack by crafting a malicious collaborationInstruction. This crafted instruction is then stored on a Bedrock Agent collaborator. The vulnerability doesn’t immediately trigger upon storage. Instead, it activates when another user, operating within the same AWS account, imports the agent associated with this collaborator. During the agent import process, the vulnerable AgentCore CLI processes the malicious collaborationInstruction, leading to the improper Python code generation and subsequent arbitrary code execution.
This allows code execution in two contexts: on the AWS AgentCore Runtime, inheriting the imported agent’s IAM execution role, and on the local machine of the user performing the import. No public PoC is available at the time of writing. Researchers investigating this vulnerability would need to identify how collaborationInstruction data is parsed and integrated into Python code by the AgentCore CLI to develop a working exploit.
References
Fix
To remediate this issue, users should upgrade their AgentCore CLI installations to version 0.14.2 or later.
