Which versions of AWS Ops Wheel are affected by CVE-2026-6911?

AWS Ops Wheel contains a critical JWT signature verification bypass (CVE-2026-6911, CVSS 9.8) that allows unauthenticated remote attackers to forge administrative tokens and gain complete control…. A patch is available.

How to fix or mitigate CVE-2026-6911?

Within 24 hours: Identify all AWS Ops Wheel deployments and their current versions; immediately disable external access or restrict network access to administrative functions pending patch deployment. Within 7 days: Apply vendor-released patch via GitHub PR #164 to all production and non-production instances; validate JWT signature verification is enforced post-deployment. Within 30 days: Conduct audit of administrative token issuance and access logs from deployment date forward; rotate all Cognito credentials and reset user sessions across all tenants; document remediation completion for compliance records.

AWS Ops Wheel CVE-2026-6911

Q: What is the CVSS score of CVE-2026-6911?

CVE-2026-6911 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25576 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-24 AMZN

Jwt Attack Information Disclosure

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Apr 24, 2026 - 17:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Apr 24, 2026 - 17:00 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 16:30 euvd

EUVD-2026-25576

Analysis Generated

Apr 24, 2026 - 16:30 vuln.today

Patch released

Apr 24, 2026 - 16:30 nvd

Patch available

CVE Published

Apr 24, 2026 - 16:08 nvd

CRITICAL 9.3

DescriptionCVE.org

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User Pool, via a crafted JWT sent to the API Gateway endpoint.

To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

AnalysisAI

Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.

Technical ContextAI

AWS Ops Wheel is an AWS-native operational tool for managing infrastructure tasks. The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature), where the application accepts JWT tokens without validating their cryptographic signatures. JWT (JSON Web Tokens) rely on cryptographic signatures to ensure authenticity - the absence of signature verification allows attackers to craft arbitrary tokens with any claims, including administrative privileges. The flaw affects the API Gateway endpoint authentication layer, which should validate tokens issued by AWS Cognito but instead trusts the token payload without signature checks. This is a textbook example of security control bypass through incomplete cryptographic validation, particularly dangerous in multi-tenant cloud environments where privilege escalation can cross organizational boundaries.

RemediationAI

Immediately redeploy AWS Ops Wheel from the updated GitHub repository incorporating the fixes from pull request #164 at https://github.com/aws/aws-ops-wheel/pull/164. Organizations running forked or derivative implementations must manually apply the JWT signature verification patches from the upstream fix. The remediation requires full redeployment rather than in-place patching, so plan for brief service interruption and test in non-production environments first. Until redeployment is complete, implement network-level access controls to restrict API Gateway endpoint access to trusted IP ranges only - this reduces but does not eliminate risk, as internal threats and compromised credentials can still exploit the flaw. Organizations unable to immediately redeploy should consider temporarily disabling the AWS Ops Wheel deployment until patching is complete, weighing operational impact against the critical security exposure. Review Cognito User Pool access logs for suspicious administrative actions or unexpected user modifications that may indicate prior exploitation. Refer to official AWS security bulletin AWS-2026-018 for additional vendor guidance.