Cross-Tenant Data Exfiltration in AWS Bedrock Agent Knowledge Bases
Overview
A high-severity information disclosure vulnerability was identified in the Amazon Web Services (AWS) Bedrock service, specifically within the Agents for Bedrock feature. The flaw resided in the authorization and resource isolation mechanisms for knowledge bases backed by Amazon S3. Researchers from cloud security firm Orca Security discovered that under specific conditions, an authenticated but unauthorized user could craft a malicious Bedrock Agent in their own AWS account that could query and retrieve documents from a knowledge base in a different victim account. The attack required the attacker to guess the unique identifier (Knowledge Base ID) of the target knowledge base. While these IDs are non-sequential and long, they could potentially be leaked through public code repositories, application logs, or misconfigured IAM policies. The root cause was an improper authorization check in the API endpoint that retrieves knowledge base chunks for Retrieval Augmented Generation (RAG). The check validated the caller's identity but failed to consistently verify that the requested Knowledge Base ID belonged to the caller's AWS account. This allowed an agent to 'jump' tenants and access data it was not authorized to see, leading to potential exfiltration of sensitive RAG source data.
Affected Systems
Testing Guide
1. **Patch Verification**: This vulnerability was patched on the AWS backend, so direct testing by customers is not feasible or necessary. 2. **Confirm Service Health**: Check the AWS Health Dashboard for the official notification regarding this issue (ref: AWS-2026-007) to confirm the timeline of the fix. 3. **Review IAM Policies**: Ensure your IAM policies for Bedrock are scoped with the principle of least privilege, restricting which principals can invoke agent actions.
Mitigation Steps
1. **No User Action Required**: AWS has patched the vulnerability on their backend infrastructure. All Bedrock customers are protected automatically. 2. **Audit Knowledge Base IDs**: As a best practice, audit where your Bedrock Knowledge Base IDs are stored or logged to prevent potential leaks that could be used in other future attacks. 3. **Implement Logging and Monitoring**: Use AWS CloudTrail to monitor API calls to Bedrock and configure alerts for anomalous access patterns or requests originating from unexpected sources.
Patch Details
The vulnerability was remediated by AWS on their backend on 2026-06-29. The patch involved adding a strict tenant-boundary check to the internal API endpoint responsible for fetching knowledge base data.