Detections
Analytics
SCA: security update for bedrock-agentcore-starter-toolkit (GHSA-xfhr-q72q-jcrj)
medium Tenable Cloud Security Plugin ID 438908
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may
allow a remote actor to inject code during the build process, leading to code execution in the AgentCore
Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before version v0.1.13 who
build or have built the Toolkit after September 24, 2025. Any users on a version >=v0.1.13, and any users
on previous versions who built the toolkit before September 24, 2025 are not affected. To remediate this
issue, customers should upgrade to version v0.1.13. (CVE-2026-4269)
Solution
Update the bedrock-agentcore-starter-toolkit library and its related packages to version 0.1.13 or later.See Also
Plugin Details
Severity: Medium
ID: 438908
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 3/18/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.48
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-4269
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.8
Threat Score: 1.5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/17/2026
Vulnerability Publication Date: 3/16/2026
Reference Information
CVE: CVE-2026-4269