AWS Bedrock Guardrails Misconfiguration Allows Cross-Tenant Prompt Exfiltration
Overview
A critical vulnerability was identified in the AWS Bedrock Guardrails service, allowing for cross-tenant data leakage under specific misconfiguration scenarios. The vulnerability resides in the interaction between the Guardrails content filtering policies and the underlying shared infrastructure for foundation model inference. When a Guardrail policy with complex regex-based denied topics was applied to a provisioned throughput endpoint, an attacker could craft a malicious prompt that triggered a race condition in the service's caching layer. This race condition could cause the system to incorrectly associate a cached data fragment from a previous, concurrent request (belonging to a different tenant) with the attacker's session. The result is that sensitive information, such as parts of another user's prompt or the model's response to it, could be exfiltrated and returned to the attacker. The attack required precise timing and knowledge of the Guardrail policy structure, but it posed a significant risk in multi-tenant environments where organizations rely on Guardrails for data loss prevention (DLP) and policy enforcement. The issue was discovered by independent security researchers and reported privately to AWS, who subsequently patched the caching logic and issued guidance on secure Guardrail policy configuration.
Affected Systems
Testing Guide
1. Verify that your AWS environment has been updated with the patch released by AWS in early July 2026. This is the primary mitigation. 2. Create a test Guardrail with a complex regex filter designed to deny specific PII patterns. 3. In a controlled test environment, configure two separate IAM roles representing different tenants accessing the same provisioned model endpoint. 4. Use an orchestration tool to send a high volume of concurrent, varying prompts from both roles to the endpoint. 5. Analyze the responses received by one role to check for any data fragments originating from the prompts of the other role. If no leakage is observed, the patch is effective.
Mitigation Steps
1. Ensure all AWS Bedrock service updates are applied promptly. AWS has patched the underlying service infrastructure. 2. Review and simplify Guardrail policies. Avoid overly complex, computationally expensive regular expressions in denied topic filters, as these were a contributing factor. 3. Implement strict IAM policies to limit which roles can configure or modify Bedrock Guardrails, reducing the risk of accidental misconfiguration. 4. Enable detailed CloudTrail logging for Bedrock API calls and regularly audit logs for anomalous prompt patterns or unexpected responses.
Patch Details
AWS deployed a server-side patch to the Bedrock infrastructure in July 2026. No client-side action is required, though policy review is recommended.