Cross-Tenant Data Exfiltration in AWS Bedrock Custom Model Import
Overview
A critical vulnerability was discovered in the AWS Bedrock custom model import feature, allowing an attacker to exfiltrate sensitive data from other tenants' provisioned throughput instances. The issue stemmed from improper input validation and insufficient isolation during the model validation and conversion process. An attacker could craft a malicious model archive containing a specially formatted manifest file with a crafted S3 URI. When the Bedrock service processed this archive, its internal validation service would resolve the URI and, due to a Server-Side Request Forgery (SSRF) vulnerability in the validation microservice, attempt to access data from internal endpoints corresponding to other customers' provisioned model deployments. If successful, portions of the targeted model's configuration, and in some cases sampled inference data, could be embedded into the error messages returned to the attacker's import job logs. This allowed a low-privileged attacker in one AWS account to potentially access proprietary model information and sensitive inference data from other customers. The vulnerability was discovered by a security researcher at Bishop Fox during a routine audit and was responsibly disclosed to AWS. AWS patched the issue by implementing stricter URI validation, network segmentation for the import service, and removing verbose error logging.
Affected Systems
Testing Guide
1. This vulnerability was patched by AWS, so it is no longer possible to test for it directly. 2. To verify your security posture, review your IAM policies for the `bedrock:CreateModelImportJob` permission. 3. Check CloudTrail logs for any invocations of the `CreateModelImportJob` API call from unexpected sources or with unusual parameters prior to the patch date.
Mitigation Steps
1. The vulnerability was patched server-side by AWS on June 10, 2026. No direct user action is required for mitigation. 2. Review AWS CloudTrail logs for any suspicious or failed model import jobs originating from untrusted principals between February 2026 and June 10, 2026. 3. Implement strict IAM policies to limit which users and roles have `bedrock:CreateModelImportJob` permissions. 4. For highly sensitive models, consider using VPC endpoints for Bedrock to further restrict network paths.
Patch Details
The vulnerability was patched by AWS globally on their backend infrastructure on June 10, 2026. No customer-side updates are needed.