Security Advisory Desk
unratedQCS priority 70/100Amazon Web Services

CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation

An input validation flaw was found in the Amazon Bedrock AgentCore harness's InvokeHarness API. This flaw lets authenticated users bypass normal model checks and directly activate certain configured tools, potentially leading to unauthorized tool execution. The risk depends on which tools are set up in each harness. AWS fixed this by adding checks on their servers to reject unsafe requests before they can trigger these tools.

Published 9/9/2026, 9:30:11 pmVerified 10/9/2026, 4:52:54 amRevision 1
Amazon Web Services unrated network security advisory visual

In plain language

What this advisory means

An input validation flaw was found in the Amazon Bedrock AgentCore harness's InvokeHarness API. This flaw lets authenticated users bypass normal model checks and directly activate certain configured tools, potentially leading to unauthorized tool execution. The risk depends on which tools are set up in each harness. AWS fixed this by adding checks on their servers to reject unsafe requests before they can trigger these tools.

Technical explanation

How the issue affects the environment

CVE-2026-18830 affects the Amazon Bedrock AgentCore harness InvokeHarness API prior to July 31, 2026. The vulnerability arises because the agent event loop can directly dispatch tools named in the last message of an InvokeHarness request if it contains a 'tool-use' content block. This bypasses the intended model invocation and associated security controls. The impact scope is limited by the tools configured per harness; harnesses without configured tools cannot execute any, and those with restricted tool sets can only invoke those tools. AWS implemented server-side input validation rejecting caller-supplied 'tool-use' content blocks in the final message of InvokeHarness requests before the agent event loop processes them, effectively mitigating the issue for all requests.

Operational impact

Why teams should care

An authenticated user could exploit this vulnerability to execute configured tools directly, circumventing the normal security layers and checks provided by model invocation. This may lead to unauthorized actions limited by the tools configured in the harness. Organizations risk misuse of tools, possible automation of unintended operations, and compromise of operational security depending on deployed tools in affected harnesses.

Immediate action

AWS added server-side input validation that rejects caller-supplied 'tool-use' content blocks in the final message of an InvokeHarness request before it reaches the agent event loop. This mitigation is applied automatically on the AWS-managed service side for all requests.

Affected and fixed releases

Affected versionsversions prior to July 31, 2026
Fixed versionsConfirm in the official vendor advisory

Temporary risk reduction

None required. The mitigation is applied automatically on the server side for all requests.

Evidence and validation checklist

  • CVE identifier CVE-2026-18830 assigned.
  • Description from AWS Security Bulletin 2026-073-AWS detailing the issue and potential impact.
  • AWS statement of implemented server-side input validation mitigating vulnerability.
  • Publication date 08/04/2026 and advisory URL https://aws.amazon.com/security/security-bulletins/rss/2026-073-aws/.

Authoritative reference

AWS Security Bulletins

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source