Loom for AWS CVE-2026-103958

Exploitation requires an authenticated account with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) - consistent with PR:H. The attacker supplies a crafted connection address (e.g., the AWS instance/container metadata endpoint at 169.254.169.254 or an internal host); the server-side fetcher then follows redirects and echoes the response body back, which is the mechanism enabling credential and internal-data disclosure. Limiting factors: no anonymous/pre-auth path (privileged integration-management access is mandatory), exploitation depends on the container running with an IAM role worth stealing, and deployments on or upgraded to 1.7.0 (which adds the IP-validated, DNS-pinned fetcher and connection-sink guards) are not affected.

This is a credible, high-priority finding for anyone actually running Loom for AWS, but the real-world risk is bounded by its prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires HIGH privileges (PR:H) - the actor must already be an authenticated user with rights to register, update or test a tool server or remote agent, so this is not a pre-auth internet mass-exploitation bug. Its severity comes from impact, not accessibility: VC:H plus SC:H reflect that the SSRF can reach the AWS instance/container metadata endpoint and disclose the application's own container IAM role credentials, enabling lateral movement into the surrounding AWS account - a classic SSRF-to-cloud-credential-theft escalation (CWE-918). No EPSS score was provided and the CVE is not in CISA KEV; there is no public exploit identified at time of analysis, so exploitation probability signals are absent rather than reassuring. There is no conflict between the CVSS vector and the description - both agree on network vector plus authenticated/privileged access. The practical priority is HIGH for Loom operators (credential theft is confirmed by the vendor advisory and the fix) but is naturally scoped by the small deployment footprint and the privileged-insider or compromised-account precondition.

An authenticated user (or an attacker who has phished/compromised a privileged Loom account) with permission to manage integrations registers or 'tests' a tool server / remote agent, supplying a crafted connection address pointing at the AWS metadata service or an internal host. The backend fetches that address server-side, and because responses are echoed back (and redirects followed), the attacker reads the container role's temporary IAM credentials and probes otherwise-unreachable internal endpoints. No public exploit code is identified at time of analysis, but the technique is well-understood and the trigger is a normal product feature.