The vulnerability is a server‑side request forgery in the OpenAPI schema processing of the agent import function in Amazon Bedrock AgentCore Starter Toolkit. An authenticated remote user within the same AWS account can craft external reference values in the OpenAPI content associated with a Bedrock Agent action group, causing the environment that processes the import to issue arbitrary outbound HTTP requests and read arbitrary local files on the host. This can lead to data exfiltration or harmful interactions with external services.

Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14. Any user importing an agent using a version older than 0.3.14 is vulnerable, and the deprecated package should be replaced with the @aws/agentcore npm CLI which has no known issue.

The vulnerability has a CVSS score of 5.7, with no EPSS data available and it is not listed in CISA KEV. The attack requires authentication within the same AWS account and the ability to import a Bedrock Agent with custom OpenAPI content; however, once those conditions are met the attacker can cause the environment to perform arbitrary HTTP requests and read local files, presenting a moderate risk to confidentiality.