{
 "id": "AIR-2026-0252",
 "slug": "ssrf-in-amazon-bedrock-agentcore-starter-toolkit-openapi-sch",
 "title": "SSRF in Amazon Bedrock AgentCore Starter Toolkit OpenAPI Schema Processing",
 "summary": "A server-side request forgery flaw in the Amazon Bedrock AgentCore Starter Toolkit enabled remote actors to issue unauthorized outbound requests. Users were instructed to upgrade to version 0.3.14 to resolve the issue.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "Amazon",
  "framework_or_tooling"
 ],
 "products": [
  "Amazon Bedrock AgentCore Starter Toolkit"
 ],
 "incident_date": "2026-10-06",
 "incident_date_precision": "day",
 "first_reported": "2026-10-06",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106032",
   "publisher": "NVD",
   "title": "CVE-2026-106032: Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore…",
   "published_at": "2026-10-06"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-106032",
  "ssrf",
  "bedrock"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}