AWS Ops Wheel CVE-2026-6912

Exploitation requires authenticated access to AWS Ops Wheel with at least low-privilege user credentials (PR:L in CVSS vector). The vulnerable Cognito User Pool configuration must be deployed from AWS Ops Wheel versions prior to PR #165. No special features or non-default configurations are required - the vulnerability exists in the baseline UpdateUserAttributes API handling logic. Attack surface is network-accessible (AV:N) and does not require user interaction (UI:N), meaning any authenticated user with API access can attempt exploitation independently. Exploitation is limited by authentication requirement - unauthenticated remote attackers cannot exploit this vulnerability. Organizations not using AWS Ops Wheel's Cognito User Pool integration are not affected.

Real-world risk is HIGH despite lack of active exploitation evidence. CVSS 8.7 accurately reflects severe impact: high confidentiality/integrity/availability violation in primary scope (VC:H/VI:H/VA:H) plus limited secondary scope impact (SC:L/SI:L/SA:L), indicating potential for lateral movement beyond the immediate application. Attack vector is network-accessible (AV:N) with low complexity (AC:L) and only low-privilege authentication required (PR:L) - any legitimate low-privilege user becomes a threat actor. No EPSS score provided, but privilege escalation vulnerabilities in cloud infrastructure tooling typically see exploitation within 30-90 days of disclosure due to their strategic value in compromising AWS environments. Not currently in CISA KEV, suggesting no widespread exploitation detected, but the technical barrier is minimal. SSVC assessment: exploitation status is POC (public fix reveals vulnerability mechanics), automatable given API-based attack vector, technical impact is total (admin escalation). Priority is HIGH for organizations using AWS Ops Wheel in production, especially multi-tenant or shared environments where privilege boundaries are security-critical.

An authenticated attacker with standard user credentials logs into an AWS Ops Wheel deployment and captures a legitimate UpdateUserAttributes API call to Cognito User Pool. They craft a modified request adding the custom:deployment_admin attribute set to true or an administrative value, bypassing the application's intended authorization controls. Upon successful attribute modification, the attacker's session now carries deployment admin privileges, granting full access to manage Cognito user accounts, modify deployment configurations, and potentially pivot to other AWS resources managed by Ops Wheel. Public availability of PR #165 details provides clear blueprint for exploitation mechanics.