Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
awslabs/agentcore-samples
main @ a444af4
19
Fixes
0
CVEs
HIGH
Peak severity
92.9%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
02-use-cases/market-trends-agent/deploy.py: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The gateway interceptor tutorial relied on unverified JWT parsing, allowing attackers to forge tokens and bypass custom scope-based authorization entirely. Secure signature verification and claims validation are required.
Code Injection: Using standard python `eval()` to process mathematical input in agent tools allows arbitrary code execution. Evaluation must be done safely via AST parsing.
Access Control: Binding local service endpoints directly to 0.0.0.0 (wildcard interface) permits unauthenticated LAN-wide access to backend endpoints, risking the exposure of sensitive credentials.