CVE-2026-18830

HIGH

Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-18830 has a selected CVSS score of 8.6 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Amazon Bedrock AgentCore harness

Browse AWS / Amazon Bedrock AgentCore harness

Default status: unaffected

CVE ListVersion range not suppliedaffected

Proofs of concept

1

Repository PoCs

GitHubhuzjie/aegisagentRepository PoCby huzjie0Writeup248 files

1.7 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a repository for AegisAgent, an AI agent runtime security gateway. It contains documentation, project structure, and source code for a defensive security tool, but no exploit or scanner code for payload withheld. The README discusses the CoreBreak vulnerability family and maps payload withheld to a defensive mechanism (Provenance Attestation). The code implements a static risk scanner for MCP tools, a CLI, and an API, all of which are defensive components, not offensive PoC code.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files constitute a Python project (AegisAgent) that presents itself as an AI agent runtime security gateway. The code defines a CLI, lazy imports, a static MCP tool scanner, and version metadata. No backdoor, trojan, or deceptive payload behavior is observed in the supplied readable text. The project appears to be a legitimate security tool addressing the referenced payload withheld.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesPythonMarkdown
Target softwareAmazon Bedrock AgentCore harness
Attack typesInput Data Manipulation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a defensive security tool (AegisAgent) that discusses payload withheld in its documentation and provides defensive mechanisms. It contains no code that exploits or scans for the vulnerability. The code implements a static risk scanner, a CLI, and an API, all of which are defensive components. The README provides a substantive technical analysis of the CoreBreak vulnerability family and maps payload withheld to a defensive mechanism, which is characteristic of a writeup.

README.md:15-24README.md:131-139aegis/mcp/scanner.py:1-13aegis/cli/commands/check.py:25-30

Observed behavior

  • The README describes AegisAgent as a defensive security gateway that provides provenance attestation, policy engine, detection layer, sandbox isolation, and other security features to protect AI agents.README.md:9README.md:33-53
  • The README maps payload withheld to a defensive mechanism (Provenance Attestation) and states it is defended.README.md:135
  • The MCP scanner module performs static risk analysis of tool definitions to assign risk bands and advisory flags, but does not exploit any vulnerability.aegis/mcp/scanner.py:1-13aegis/mcp/scanner.py:139-199
  • The CLI 'check' command evaluates a tool call and returns a mock decision, not an actual exploit.aegis/cli/commands/check.py:25-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Project Purpose
Payload withheldThe project directly addresses payload withheld and related vulnerabilities, consistent with its stated purpose.README.md:1-229aegis/__init__.py:1-91
Cve Reference
Payload withheldThe artifact is associated with this CVE and claims to provide defenses against it.README.md:19README.md:135
Code Behavior
Payload withheldThe scanner performs keyword-based risk analysis on tool names, descriptions, and parameters. It does not execute any tools or external commands.aegis/mcp/scanner.py:1-257
Code Behavior
Payload withheldThe 'check' command in aegis/cli/commands/check.py returns a hardcoded mock decision ('deny' if tool starts with 'dangerous.', else 'allow') and does not perform real evaluation or execute the tool.aegis/cli/commands/check.py:25-30
Review boundaries

What the analysis did not establish

  • Only 8 of 248 files were included in the evidence; the remaining 240 files were omitted due to size constraints, so the analysis may not cover all code in the repository.
  • The evidence does not include any binary files, but the packet metadata indicates 240 unclassified files, which could contain additional code or documentation not reviewed.
  • Only 8 of 248 total files were provided as readable text; the remaining 240 files were omitted and their content is unknown.
  • Binary files were flagged as metadata-only and not analyzed; the inventory reports zero binary files, but this cannot be independently verified.
  • The review is limited to static analysis of the supplied text; no dynamic execution or deeper dependency analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yaml

huzjie/aegisagentCreated Vuln labCVE-2026-18830Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A containerized environment for AegisAgent, an AI Agent Runtime Security Gateway. It consists of a server built from a Dockerfile, and two optional example services (example-agent, mcp-server) that demonstrate client usage. The server exposes HTTP (8901) and WebSocket (8902) ports, mounts named volumes for config, data, and logs, and runs as a non-root user.

docker-compose.yaml:1-80Dockerfile:1-44

Lab assessment

Vulnerability lab

The project description in pyproject.toml explicitly states it is a 'Runtime security gateway and privilege governance platform for AI agents' and includes 'red-team harness' in its keywords. The source code contains extensive security components (provenance, detection, sandbox, approval, audit) and references to CVEs (CVE-2026-18830, CVE-2026-18236, CVE-2026-64650) in aegis/core/types.py, indicating a vulnerability research or reproduction purpose.

pyproject.toml:5-6aegis/core/types.py:1-746
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

aegis-server

security gatewayAPI serverpolicy enforcementprovenance verificationapproval workflowaudit ledger

The main AegisAgent server, built from the Dockerfile. It runs 'python -m aegis.cli serve' on port 8901, with a healthcheck on /health. It mounts volumes for config, data, and logs, and uses environment variables for log level, policy directory, and audit backend.

docker-compose.yaml:4-28Dockerfile:1-44

example-agent

demonstration clientexample agent

An optional service (profile 'examples') that installs aegisagent[all] and runs /app/examples/quickstart.py. It depends on aegis-server being healthy and connects via AEGIS_GATEWAY_URL.

docker-compose.yaml:30-47

mcp-server

MCP proxyoptional demonstration

An optional service (profile 'mcp') that installs aegisagent[all] and runs /app/examples/mcp_proxy.py. It depends on aegis-server and exposes port 8910.

docker-compose.yaml:49-66
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-18830

Supported by supplied evidence

The source code in aegis/core/types.py explicitly documents the ProvenanceStatus enum as a defence against 'CoreBreak' class bypasses, listing CVE-2026-18830 among the referenced CVEs. The provenance subsystem (aegis/core/types.py, aegis/detect/__init__.py) is designed to verify tool-call provenance, directly addressing the described vulnerability.

aegis/core/types.py:1-746
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the services.docker-compose.yaml:1-3
  • The aegis-server service must be built from the Dockerfile, which requires the build context (aegis/ source code and pyproject.toml).docker-compose.yaml:5-7Dockerfile:1-44
  • The example-agent and mcp-server services require the ./examples directory to be present and contain quickstart.py and mcp_proxy.py respectively.docker-compose.yaml:30-47docker-compose.yaml:49-66

Evidence-described exercise path

  1. Build and start the aegis-server service using 'docker compose up aegis-server'.docker-compose.yaml:4-28
  2. Optionally start the example-agent service with 'docker compose --profile examples up example-agent' to run a demonstration client that connects to the gateway.docker-compose.yaml:30-47
  3. Optionally start the mcp-server service with 'docker compose --profile mcp up mcp-server' to run an MCP proxy demonstration.docker-compose.yaml:49-66
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained lab for an AI security gateway. The server runs as a non-root user, uses named volumes for data, and exposes only the documented ports. The example services are optional and only connect to the internal gateway. No evidence of host escape, external connectivity, credential theft, persistence, or destructive behavior beyond the intended lab target is present.

docker-compose.yaml:1-80Dockerfile:1-44
Review boundaries

What the analysis did not establish

  • The ./examples directory referenced by example-agent and mcp-server is not included in the evidence files, so the exact behavior of quickstart.py and mcp_proxy.py is unknown.
  • The packet omits 120 files from the repository due to selection limits; some source files (e.g., aegis/gateway/, aegis/frontend/, aegis/mcp/) are not fully inspected.
  • The compose file uses profiles for example services, so they do not start by default; the default 'docker compose up' only starts aegis-server.
  • The CVE association selected only CVE-2026-18830 from the unit's content identifiers, but the source code also references CVE-2026-18236 and CVE-2026-64650; these were not assessed per the instruction to assess only the unit_cve_ids array.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

2