MANY MINDEDAWS AgentCore Vulnerability Enables Credential Theft Through Metadata Leaks
Zenity Labs identified a vulnerability in AWS AgentCore that enabled attackers to extract credentials through Instance Metadata Service (IMDSv1) endpoints. This allowed unauthorized access to Amazon Elastic Container Registry (ECR) container images and agent sessions using temporary credentials transmitted in metadata. The flaw required only a single prompt requesting credentials to compromise all AgentCore agents within a single AWS account and region. AWS resolved the issue by updating AgentCore to exclusively use IMDSv2 by February 14, 2026, though Zenity Labs confirmed the excessive permissions issue persisted until June 22, 2026. The default AgentCore IAM role granted broad permissions across all resources in a region rather than individual agents, creating a pathway for unauthorized access. AWS stated the vulnerability required specific developer error conditions not described in Zenity Labs' research, suggesting the attack scenario was not a documented flaw but a misrepresentation of normal behavior.
This friction in cloud security directly impacts the accessibility of critical infrastructure services. When cloud platforms become vulnerable to credential theft, users—especially those relying on free or low-cost services—face heightened risk of service disruption or data exposure. The vulnerability’s potential for rapid compromise through a single prompt creates a gatekeeping barrier for cloud adoption, particularly for resource-constrained entities that depend on secure, uninterrupted access to digital tools.
What to watch: AWS’s claim that the vulnerability requires developer error conditions, and whether Zenity Labs’ resolution timeline aligns with actual operational security. The source notes this scenario uses a hypothetical attacker 'Bob' and the resolution date reflects Zenity Labs’ observation, not AWS’s formal confirmation.
Source: The Register