CVE-2026-11393: AWS Bedrock AgentCore Multi-Agent Collaboration Poisoning via Triple-Quote Injection RCE

HERMES

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: AWS Bedrock AgentCore CLI Agent Code Generator

Confidence: 96%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates this vulnerability at 8.8. Hermes Threat Score rates it at 94 (CRITICAL) taking into account active exploit telemetry, critical AI workflow dependencies, and immediate host privilege escalation.

HASS

HASS AGENTIC SEVERITY & AUTONOMOUS RISK EVALUATION

Target: AWS Bedrock AgentCore CLI Tool & Memory Architecture

Confidence: 95%

96 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 20 / 20

Tool Access 20 / 20

Privilege 20 / 15

Persistence 18 / 15

External Impact 20 / 15

Propagation 20 / 15

⚖️ Divergence & Operational Rationale

Agentic security failure classified under AAP-003 (Multi-Agent Topology Hijacking) -> AAP-007 (IAM Privilege Abuse). The flaw collapses trust boundaries between autonomous model reasoning loops and operating system execution tiers.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-11393: AWS Bedrock AgentCore Multi-Agent Collaboration Poisoning via Triple-Quote Injection RCEVULNERABILITY

Connected Nodes: 5

Active Relationships (Outgoing)

→ affectsPRODUCTAWS Bedrock AgentCore CLI

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in AWS Bedrock AgentCore CLI documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass

92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-11393 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

→ exploitsAGENTIC ATTACK_PATTERNAAP-007: Autonomous Cascading RCE

92% VERY_HIGH

Cascading multi-stage attack chaining context injection, autonomous loop planning, and un-sandboxed execution sinks to achieve persistent root shell compromise on host machines.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-11393 weaponizes the agentic attack pattern formalized under AAP-007.”

Supporting Verified Evidence:

• [technical_analysis]Pillar Security demonstrated that executing export BASH_ENV in Auto-Run causes bash to source hostile payloads upon subsequent commands. — Source: Pillar Security Research: Bypassing Cursor Auto-Run: When Shell Built-ins Lead to Host RCE (Reliability: HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Vulnerability Advisory

CVSS v3.1: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) / CWE-94: Improper Control of Generation of Code (‘Code Injection’). Addressed in AgentCore CLI 0.14.2. Affects deployments running AgentCore CLI < 0.14.2.

Executive Summary

The AWS Bedrock AgentCore CLI prior to 0.14.2 improperly neutralized triple-quote characters when generating Python dispatch code from Bedrock Agent collaborator configurations. An attacker modifying the collaborationInstruction metadata on a shared agent could escape string literals, injecting arbitrary Python code that executed in the AWS AgentCore Runtime under the imported agent’s IAM execution role.

---

1. Technical Context & Attack Surface

AWS Bedrock AgentCore CLI is widely deployed in production environments to support large language model orchestration, data pipelines, and agentic workflows. CVE-2026-11393 represents a significant threat to enterprise infrastructure:

Attribute	Technical Specification	Operational Ramification
Vulnerability ID	CVE-2026-11393	Tracked in Hermes Knowledge Graph
Affected System	AWS Bedrock AgentCore CLI	Amazon Web Services
Vulnerable Component	AWS Bedrock AgentCore CLI Agent Code Generator	Input processing & execution gate
Exploit Vector	Network / Local Untrusted Context	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA KEV Status	Monitored / High Weaponization Potential	Urgent patching prioritization
Attack Techniques	T1059.006 (Python), T1078.004 (Cloud Accounts), T1552.005 (Cloud Instance Metadata API)	MITRE ATT&CK Framework
Agentic Attack Pattern	AAP-003 (Multi-Agent Topology Hijacking) -> AAP-007 (IAM Privilege Abuse)	Hermes Agentic Security Catalog

---

2. Root Cause Analysis & Mechanics

The vulnerability stems from insufficient validation and flawed isolation boundaries in AWS Bedrock AgentCore CLI Agent Code Generator:

[ Attacker Payload / Untrusted Input ]
                 │
                 ▼
[ Ingress: AWS Bedrock AgentCore CLI Agent Code Generator ]
                 │  (Missing Canonical Sanitization / Dangerous Evaluation)
                 ▼
[ Execution Tier: Host OS / Runtime Subprocess ]
                 │
                 ▼
[ Impact: Arbitrary Code Execution / Credential Exfiltration ]

When processing requests, the vulnerable logic failed to enforce strict allowlisting or canonical path validation, permitting direct execution or unauthorized file access.

---

3. Exploit Scenario & Proof-of-Concept Workflow

Defenders must understand how threat actors weaponize CVE-2026-11393 in real-world intrusion operations:

1. Target Identification & Probing: Adversaries discover exposed instances through version fingerprinting or metadata scraping.
2. Payload Delivery: A crafted request containing the exploit payload is transmitted to the vulnerable endpoint (AWS Bedrock AgentCore CLI Agent Code Generator).
3. Execution & Breakout: The application executes the payload under the process user permissions, escaping intended sandboxes.
4. Post-Exploitation & Pivot: The attacker harvests LLM API keys, establishes persistence, or moves laterally into connected cloud storage.

---

4. Detection Engineering & Hunting Rules

Security Operations Centers (SOC) and incident response teams can deploy the following detection signatures:

Sigma Rule

title: Suspicious Execution from AWS Bedrock AgentCore CLI Subprocess (CVE-2026-11393)
status: experimental
description: Detects abnormal process execution or file creation spawned by AWS Bedrock AgentCore CLI
references:
  - https://codex.hermes-cyber.com/cve/2026/cve-2026-11393/
author: Hermes Cyber Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/python'
      - '/node'
      - '/langflow'
      - '/flowise'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate administrative tooling
level: high

Audit & Hunt Log Query

# Audit suspicious connections and process executions
journalctl -u prod-aws-agentcore --since "24 hours ago" | grep -Ei "exec|spawn|attachments|validate"

---

5. Remediation & Defensive Hardening

To mitigate exposure to CVE-2026-11393:

1. Immediate Upgrade: Upgrade to AgentCore CLI 0.14.2 or later immediately.
2. Network Isolation: Restrict access to administrative interfaces and API listeners via internal VPN or Zero-Trust Network Access (ZTNA).
3. Container Sandboxing: Run workloads with non-root service accounts, read-only root filesystems, and strict seccomp/AppArmor profiles.
4. Credential Rotation: Rotate all LLM provider API keys, database credentials, and cloud secrets that resided in the environment.

---

6. Related Intelligence & Playbooks

Agentic Attack Patterns Catalog Explore formal defensive architectures for autonomous AI agents and tool-calling models.

Hermes Threat Observatory Monitor live operational threat intelligence signals and score revisions.