AWS
Monthly
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.
Code execution inside the target SageMaker execution environment, together with disclosure of the execution role's IAM credentials, is reachable through the Amazon SageMaker Python SDK's default_bucket() helper, which provisions and then consumes an S3 bucket whose name is derived predictably from the account ID and region but never verifies who actually owns that bucket. The defect affects V3 releases before 3.10.0 and V2 releases before 2.257.3; a remote actor who registers that predictable bucket name in their own AWS account first can influence the artifacts, scripts and data the victim's training, processing and hosting jobs read and write, which the vendor scores 9.4 (Critical) under CVSS 4.0 and which our independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attacker must win a bucket-name pre-creation race. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation favors newly onboarded or not-yet-provisioned environments, since targets that already own their default bucket are not exposed.
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Amazon Neptune engine versions prior to 1.5.0.0 contain a deserialization flaw in the Gremlin graph data import component that lets an authenticated remote actor holding standard database permissions execute arbitrary code and reach internal service credentials. Exploitation requires working database credentials and network access to the Gremlin import interface, so exposure is greatest in multi-user, multi-tenant, or lower-trust deployments where untrusted parties hold standard DB accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high CVSS 4.0 score (9.4) and our independent CVSS 3.1 assessment (8.8, scope-changed, high confidentiality/integrity/availability impact) confirm this is a genuine high-priority issue rather than a CVSS-inflated one. Vendor-released patches are available as engine version 1.5.0.0 with backports to 1.4.8.1 and 1.4.7.1, and clusters enrolled in auto-update may be remediated without operator action.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Arbitrary code execution in AWS Bedrock AgentCore Starter Toolkit before 0.3.14 allows an authenticated same-account actor to inject malicious Python code into generated agent source by importing a crafted Bedrock Agent configuration, which executes when the victim runs or deploys the agent. Exploitation requires the victim to import and then run or deploy the agent, and the actor must have valid same-account credentials. No public exploit identified at time of analysis; remediation requires upgrading to 0.3.14 and re-importing any previously affected agents because the generated source persists.
Authorization bypass in the optional Amazon Q Business Lambda hook sample shipped alongside QnABot on AWS 7.0.0 through 7.4.5 lets an authenticated remote user cause the hook to read arbitrary Amazon S3 objects in the deploying AWS account, exposing data the caller should not be able to reach. Only customers who separately and manually deployed the q-business-lambda-hook sample stack on top of an affected QnABot version are exposed; the hook is not installed by default and the impact is limited to confidentiality within that account. Vendor-released patch: 7.4.6, and no public exploit identified at time of analysis. Per the authoritative assessment this is a moderate, conditional risk rather than a widespread emergency, because exploitation depends on the optional component being present, on authenticated access to the hook's request path, and the resulting impact is S3 object read only.
OS command injection in the Studio Space startup validation script of Amazon SageMaker Distribution (2.x, 3.x, and 4.x lines, as used by Amazon SageMaker Unified Studio) allows an authenticated remote user with project contributor permissions to execute arbitrary commands inside another project member's Studio Space and steal that member's temporary execution-role credentials via a crafted connection resource property. Exploitation is a shared/multi-tenant insider or compromised-collaborator scenario rather than unauthenticated external access, and it is additionally gated by user interaction because the victim's Studio Space must start and run the vulnerable startup script for the injected command to reach that member. No public exploit identified at time of analysis; vendor-released patches exist for supported lines, and end-of-support minor lines will not receive a fix.
Server-side request forgery in Loom for AWS before 1.7.0 lets an authenticated user with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) supply a crafted connection address that the backend fetcher follows and whose response body it echoes back, exposing the application container's own IAM role credentials and responses from arbitrary internal network locations. Exploitation requires a high-privileged authenticated account (CVSS PR:H) and is only meaningful where the container runs with a role worth stealing; there is no anonymous or pre-authentication path, and no public exploit identified at time of analysis. Deployments on or upgraded to 1.7.0, which adds IP-validated, DNS-pinned fetchers and connection-sink guards, are not affected.
Server-side request forgery in the OAuth2 discovery handling of Loom for AWS (awslabs/loom) before 1.7.0 lets an authenticated user who can register a tool server or remote agent supply a crafted discovery document address, causing the backend to make requests to arbitrary internal network locations and - in deployments using delegated authentication - to leak another user's access token. The prerequisites are meaningful: the attacker needs high privileges to register the tool server/remote agent (PR:H) and the token-disclosure outcome requires passive interaction from a victim user (UI:P), so this is a credible, above-average-priority issue rather than an emergency, and it only affects deployments actually using the OAuth2/OIDC delegated-authentication discovery feature. There is no public exploit identified at time of analysis; the vendor has released Loom 1.7.0, which adds a deployment-trusted issuer host requirement before any token exchange and applies an IP-validated, DNS-pinned fetcher to all outbound OAuth2/OIDC calls.
Loom for AWS deployments running a version before 1.6.1 with no identity provider configured expose an unauthenticated super-admin takeover of the agent control plane, allowing any remote party to register tool servers, read stored integration credentials, and rewrite the IAM role policies attached to managed agent roles simply by sending requests to the application API; no credentials, user interaction, or crafted payload are required. The flaw is a missing-authentication-for-critical-function (CWE-306) defect in the authentication dependency, where the local-development bypass intended for environments without Cognito/OIDC activated automatically for every request instead of failing closed. Exploitation is conditional on that IdP-less configuration, so environments with a properly configured identity provider are not reachable through this path; a vendor patch ships in 1.6.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Deserialization of untrusted data in the GluonTS model-loading component allows arbitrary OS command execution with the privileges of the loading process when a victim loads a crafted serialized model directory in versions before 0.17.0. The flaw is scored 8.4 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication is required but exploitation is local and depends on a user actively loading the malicious model artifact; the attacker must first place that artifact in the victim's load path (untrusted model hub, shared directory, or compromised pipeline), and environments that only load self-generated trusted models are not affected. AWS has released a fix in GluonTS 0.17.0 (upstream PR #3304, '[Security] Resolve security issue for torch.load'), and no public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS data was not provided for this CVE.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 through 1.6.0 running on Python 3.7 and later allows an adversary-in-the-middle who possesses a certificate issued for an unrelated hostname by a certificate authority already in the device trust store to impersonate the AWS IoT Core endpoint, read device telemetry, and inject MQTT messages that the device processes as authentic. This is not exploitable from an arbitrary internet location: the attacker must hold an on-path position and a trusted-CA certificate for an unrelated hostname. No public exploit was identified at time of analysis, and the vendor has released 1.6.1 to enforce hostname verification.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
SSRF in AWS Systems Manager Agent's port-forwarding feature allows an authenticated remote user to bypass the link-local address denylist and reach the EC2 Instance Metadata Service (IMDS), enabling theft of the managed instance's temporary IAM role credentials. The bypass exploits insufficient canonicalization of IP addresses before denylist evaluation - alternate representations of 169.254.169.254 (hex, decimal, IPv6-mapped, etc.) pass the check unblocked. With stolen credentials, the attacker can exercise the instance's full IAM role permissions from outside the instance. No public exploit identified at time of analysis, but the release notes confirm the fix explicitly canonicalizes IPs and extends the denylist to include ECS/EKS credential endpoints.
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on the host of a self-managed PostgreSQL server, even in the server's default read-only mode. The read-only enforcement in the SQL validation component fails to reject PostgreSQL's COPY ... TO PROGRAM construct, so a crafted statement embedded in content processed when an authenticated user interacts with the MCP server executes shell commands on the database host. No public exploit identified at time of analysis; the flaw is fixed in 1.1.7 and documented in AWS bulletin 2026-104 and GHSA-fph8-pg5w-78fv.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
OS command injection in the Amazon Web Services codecatalyst-blueprints npm package (before 0.3.156) allows a repository contributor with commit access to execute arbitrary commands inside the blueprint resynthesis environment by embedding shell metacharacters in the `owner` field of a `[local]` merge strategy entry within a crafted `.ownership-file`. The attack requires both commit access to a project repository and a resynthesis trigger event, making automated mass exploitation infeasible. No public exploit has been identified and SSVC rates exploitation as none and non-automatable; users of the managed Amazon CodeCatalyst service require no action because AWS applies independent server-side allowlist enforcement and per-project environment isolation.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. Vendor-released patch is available at version 3.8.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. No public exploit code has been identified at time of analysis, but the network-reachable RCE primitive, low complexity, and low privilege requirement collectively make this a high-priority remediation target; vendor patches are available in OpenSearch 3.7.0 and 2.19.6.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's `non_interactive` parameter to `true`, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 allows a remote unauthenticated attacker - operating through prompt injection - to redirect RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint by supplying a crafted broker hostname in the MCP client context. The RabbitMQ broker connection tools fail to validate that hostnames resolved through the MCP client context correspond to legitimate Amazon MQ broker endpoints, enabling a server-side request forgery-like exfiltration primitive. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the vendor (Amazon) has released a confirmed fix in version 2.0.24.
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary commands inside the Code Interpreter sandbox by embedding shell/argument delimiters in package names passed to install_packages(). Because the CVSS vector is PR:L, an attacker needs some level of authenticated access and the flaw requires user interaction (UI:A) with a high confidentiality and integrity impact (CVSS 4.0 base 8.4). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated attackers exhaust server sockets and async tasks by opening many connections and trickling partial requests that never complete. The default serve() path ships without connection read/header timeouts or a concurrent-connection cap, so a classic slowloris-style flood can hang the service indefinitely. No public exploit has been identified at time of analysis, though the technique is well-understood and the CVSS 4.0 base score is 8.7 (High).
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Server-side request forgery in AWS awslabs.healthlake-mcp-server before 0.0.14 lets a remote authenticated user exfiltrate AWS temporary security credentials to an attacker-controlled endpoint by supplying a crafted next_token pagination parameter. Because the server never validates that paginated request URLs still point at the legitimate HealthLake FHIR datastore, subsequent authenticated calls (carrying SigV4/temporary credentials) can be redirected off-host. Rated CVSS 4.0 9.2 (critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file disclosure in AWS Research and Engineering Studio (RES) prior to version 2026.06 allows an authenticated remote user to read any file readable by root on the cluster-manager EC2 instance. The Auth.GetUserPrivateKey API follows a user-controlled symbolic link at ~/.ssh/id_rsa, and because the cluster-manager process runs as root, an attacker can exfiltrate other users' SSH private keys and application secrets. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Amazon (agentic-community) mcp-gateway-registry before 1.0.13 allows an authenticated remote user to execute arbitrary SQL queries by supplying a crafted table_name that the metrics-service retention policy component interpolates directly into SQL in identifier position. Because the injection sits in an identifier (table name) position rather than a parameterizable value, it bypasses ordinary prepared-statement protections and grants broad read/write access to the metrics datastore. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; a vendor patch (v1.0.13) is available.
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
OS command injection in AWS aws-cdk-lib lets an actor who controls a dependency version string in a project's package.json run arbitrary commands on the host executing the CDK toolchain. The flaw lives in the OsCommand helper of the NodejsFunction Docker bundling pipeline, which passes unsanitized version strings into a shell during nodeModules installation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; AWS has released a fixed version (v2.260.0).
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an HTTP/2 request body across multiple frames so that only a partial body is inspected before reaching the backend. The flaw (CWE-444, HTTP request smuggling) affects only ALB target groups serving HTTP/2 traffic with AWS WAF enabled, and lets attackers slip malicious payloads past WAF managed rules. No public exploit identified at time of analysis and it is not on CISA KEV; AWS scores it 7.9 (CVSS 4.0) with impact falling on the protected backend rather than the ALB itself.
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies past managed rule inspection by fragmenting the HTTP/2 request body across frames so only a partial body is examined. The flaw (CWE-444, request smuggling) defeats the protective security control rather than CloudFront itself, allowing attacks the WAF would normally block to reach the protected origin. AWS remediated it server-side with no customer action required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Command injection in the AWS Bedrock AgentCore Python SDK (versions >= 1.1.3, < 1.6.1) allows remote authenticated users to execute arbitrary commands within the Code Interpreter sandbox by supplying crafted package name arguments to the install_packages() method. The flaw stems from improper neutralization of argument delimiters (CWE-88), letting attacker-controlled strings break out of the intended pip-install argument context. No public exploit identified at time of analysis, but a vendor patch and advisory are available from AWS.
Client-side memory corruption in the AWS Common Runtime aws-c-http library can be triggered by a malicious HTTP/2 server that sends a crafted sequence of HEADERS frames manipulating the HPACK dynamic table size, potentially leading to arbitrary code execution in applications that use the library as an HTTP/2 client. The CVSS 4.0 score of 8.7 (High) reflects network reachability with low complexity but requires user/client interaction (initiating a connection to the attacker server). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows) allows an actor controlling bundling property values (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via shell metacharacter injection. The flaw, reported by Amazon and tracked under GHSA-999r-qq7v-r334, affects developer and CI/CD machines synthesizing CDK applications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via crafted collaborationInstruction strings stored on Bedrock Agent collaborators. When another user in the same AWS account imports the agent, the malicious triple-quote payload breaks out of the generated Python docstring and executes attacker-controlled code on AWS AgentCore Runtime under the imported agent's IAM execution role, as well as on the importing user's local environment. No public exploit identified at time of analysis, but the cross-user, cross-environment scope and 9.0 CVSS rating make this a high-priority patch.
Privilege escalation in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (GlobalDatabasePlugin) allows an authenticated low-privilege RDS user to gain the privileges of another user — including rds_superuser — by planting a malicious function on an untrusted search path that executes when the targeted user connects through the wrapper. The flaw is rated CVSS 4.0 8.6 (High) and requires user interaction (the victim must initiate a connection via the wrapper), with no public exploit identified at time of analysis. A vendor patch is available in release 2026-05-26.
Privilege escalation in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL (versions prior to 4.0.1) allows a remote authenticated low-privilege RDS user to gain the privileges of another database user - including rds_superuser - by planting a crafted function that executes when the higher-privileged user connects to the cluster through the affected wrapper. No public exploit identified at time of analysis, and the vendor (Amazon) released a fix in version 4.0.1 on 2026-05-13 that fully qualifies function calls in PostgreSQL topology detection queries to close the search-path attack surface.
Information disclosure in AWS Graph Explorer before v3.0.1 occurs because the bundled proxy server silently falls back to plaintext HTTP when its TLS certificate files cannot be loaded, causing requests intended for HTTPS to traverse the network unencrypted. Network-positioned attackers can intercept these requests and harvest sensitive graph queries, headers, or credentials. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Arbitrary command execution in Amazon Kiro IDE versions prior to 0.11 allows remote attackers to plant malicious task definitions (e.g., .vscode/tasks.json) via the IDE's file write tool, which then auto-execute when a developer opens the affected workspace folder. The CVSS 4.0 score of 8.6 reflects network-reachable abuse with high confidentiality, integrity, and availability impact contingent on a single user action (folder open). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in the Amazon Braket Python SDK (versions 1.10.0 up to but not including 1.117.0) lets a remote authenticated actor with S3 write access to a Braket job output bucket run code on any machine that later processes those job results. The SDK reads the untrusted dataFormat field from results.json and, when it is set to pickled_v4, feeds attacker-controlled data into pickle.loads(), executing code with the victim SDK user's permissions. There is no public exploit identified at time of analysis, EPSS is low (0.32%), and CISA SSVC rates exploitation as none, but the technical impact is total.
Authorization bypass in AWS Kiro CLI versions prior to 1.28.0 allows a local attacker to invoke arbitrary tools, including shell commands, without triggering the user approval prompt by piping crafted content through stdin. Reported by Amazon (AMZN) and tagged as an Authentication Bypass, this issue has a vendor-released fix in 1.28.0; publicly available exploit code exists is not indicated, and the SSVC framework currently records no observed exploitation despite a Total technical impact rating.
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible to the RabbitMQ process by submitting a crafted arn:aws-debug:file scheme to the PUT /api/aws/arn/validate validation endpoint. The flaw stems from leftover debug code in the ARN resolver and was reported by AWS itself; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the amazon-redshift-python-driver (versions prior to 2.1.14) allows a malicious or compromised Redshift server, or a man-in-the-middle attacker positioned on the network path, to execute arbitrary Python code on any client that connects. The root cause is unsafe use of Python's eval() against untrusted server-supplied data inside the vector_in() function. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and PR:N/UI:N vector make this a high-priority client-side supply-chain-style risk.
Cleartext HMAC signing key exposure in Amazon SageMaker Python SDK versions <2.257.2 and <3.8.0 enables authenticated attackers with SageMaker describe API and S3 write permissions to forge model artifact integrity signatures and achieve remote code execution in inference containers. AWS released patches in v2.257.2 and v3.8.0 with security fixes addressing Triton HMAC key exposure and missing integrity checks. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting limited exploitation activity despite high CVSS score.
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to execute arbitrary shell commands with SYSTEM privileges on the underlying host. The vulnerability exists in the FSx Windows File Server volume mounting component (versions prior to 1.103.0), where username field input is not properly sanitized before being passed to OS commands. This affects AWS customers running Windows-based ECS container workloads with FSx volumes - exploitation requires IAM permissions to register ECS task definitions or write to credential stores (Secrets Manager/SSM Parameter Store) used by FSx configurations. Vendor-released patch: version 1.103.0. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Checksum and size-validation bypass in Amazon's FreeRTOS-Plus-TCP stack (versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0) lets an adjacent-network attacker inject malformed packets by spoofing the Ethernet source MAC to match one of the device's own registered endpoint MACs, causing the loopback-detection path to skip all input validation. This is a CWE-290 spoofing/authentication-bypass flaw carrying a CVSS 4.0 base of 7.1 with integrity-only impact and no confidentiality or availability loss. No public exploit identified at time of analysis, EPSS is 0.02% (4th percentile), and CISA SSVC rates exploitation as none and automatable as no, so real-world urgency is modest despite the medium-high score.
Arbitrary code execution in AWS QnABot on AWS (versions 7.2.4 and earlier) allows an authenticated administrator to break out of the intended expression sandbox by abusing the static-eval npm package. By injecting a crafted conditional chaining expression through the Content Designer interface, an admin escapes the sandbox via JavaScript prototype manipulation and runs code inside the fulfillment Lambda, reaching backend resources not normally exposed. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%), consistent with the SSVC assessment that no exploitation has been observed.
Path traversal vulnerabilities in AWS Tough (a Rust TUF client library) versions prior to 0.22.0 enable authenticated users with delegated signing privileges to write arbitrary files outside intended repository directories, bypassing incomplete fixes from previous security patches. The flaws exist in three distinct code paths: absolute target names in copy_target/link_target operations, symlinked parent directories in save_target, and symlinked metadata filenames in SignedRole::write. AWS has released patches in tough-v0.22.0 and tuftool-v0.15.0 that implement post-resolution path containment verification. No public exploit code or active exploitation confirmed at time of analysis, though CVSS 7.1 HIGH reflects significant integrity impact when exploited.
Metadata integrity bypass in AWS tough (TUF client library) before v0.22.0 allows authenticated users with delegated signing authority to poison local metadata caches by bypassing expiration, hash, and length validation checks. The vulnerability exists because load_delegations skips specification-mandated integrity checks applied to top-level targets metadata, enabling malicious delegated signers to inject invalid metadata. AWS has released patches in tough-v0.22.0 and tuftool-v0.15.0. CVSS 7.1 reflects network vector but high attack complexity (AT:P indicates specialized conditions). No public exploit or active exploitation confirmed at time of analysis, though authentication bypass tag suggests significant trust boundary violation.
Signature duplication in AWS Tough TUF client prior to v0.22.0 allows authenticated attackers to bypass threshold signature requirements for delegated role metadata by reusing a single valid signature multiple times. The flaw undermines TUF's multi-signature integrity model, enabling acceptance of forged metadata with reduced cryptographic validation. Vendor patch available (tough-v0.22.0, tuftool-v0.15.0). No public exploit code or active exploitation confirmed at time of analysis, but CVSS 7.0 reflects high integrity impact to both vulnerable and downstream systems.
Authenticated users with low privileges can escalate to deployment admin in AWS Ops Wheel (pre-PR #165) by manipulating the custom:deployment_admin attribute through crafted UpdateUserAttributes API calls to Cognito User Pool. This privilege escalation allows full control over Cognito user account management and deployment administration. Upstream fix available via GitHub PR #165; AWS security bulletin AMZN-2026-018 confirms patch availability. No active exploitation confirmed (not in CISA KEV), but CVSS 8.7 reflects critical impact across confidentiality, integrity, and availability.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Remote command injection in AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01 allows authenticated users to execute arbitrary commands on cluster-manager EC2 instances through unsanitized input in the FileBrowser API. Vendor-released patch available (version 2026.03). No public exploit identified at time of analysis, though CVSS 7.7 reflects high impact if exploited by low-privileged authenticated users with network access.
Privilege escalation in AWS Research and Engineering Studio (RES) versions prior to 2026.03 allows authenticated remote attackers to assume virtual desktop host instance profile permissions and interact with AWS resources via crafted API requests. The vulnerability stems from unsanitized user-modifiable attributes in session creation. CVSS 8.7 (High) with network attack vector, low complexity, and requiring low privileges. Vendor-released patch available (version 2026.03). EPSS data not provided; no public exploit identified at time of analysis.
Remote code execution as root in AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01 allows authenticated remote attackers to execute arbitrary OS commands via unsanitized input in virtual desktop session names. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78 command injection), enabling privilege escalation to root on virtual desktop hosts. Vendor-released patch available in version 2026.03. CVSS 8.7 (High) with network attack vector, low complexity, and low privileges required. No public exploit identified at time of analysis, though the technical details in GitHub issue #151 may facilitate weaponization.
Arbitrary code execution in AWS Kiro IDE versions prior to 0.8.140 occurs when a local user opens a maliciously crafted workspace containing an unsanitized color theme name, exploiting improper neutralization of input during webview generation. The attack requires user interaction (trusting the workspace when prompted) and can deliver full system compromise with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though SSVC framework rates technical impact as total with manual (non-automatable) exploitation potential.
Memory corruption leading to arbitrary code execution affects AWS C Event Stream library versions before 0.6.0 when clients process malicious event-stream messages from attacker-controlled servers. The out-of-bounds write vulnerability in the streaming decoder requires high attack complexity and user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but grants complete control over confidentiality, integrity, and availability if successfully exploited. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026-dated CVE. Vendor-released patch version 0.6.0 addresses the issue.
A logic error in AWS-LC's CRL (Certificate Revocation List) distribution point validation causes the cryptographic library to incorrectly reject partitioned CRLs as out of scope, allowing revoked certificates to bypass certificate revocation checks. This authentication bypass vulnerability affects AWS-LC versions before 1.71.0 and AWS-LC-FIPS versions before 3.3.0, potentially allowing attackers to use revoked certificates for unauthorized access to systems that rely on AWS-LC for certificate validation. No active exploitation has been reported in KEV, and no EPSS score is available yet.
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local user opens a maliciously crafted project directory. The vulnerability affects all versions of Kiro IDE prior to 0.8.0 on all supported platforms and bypasses workspace trust protections designed to prevent unauthorized code execution. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability enables remote code execution through local user interaction.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal state. PoC and patch available.
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
Authenticated attackers with read and metadata-write access to encrypted objects in Amazon S3 can force a padding downgrade in the Amazon.Extensions.S3.Encryption .NET client, then use a Bleichenbacher padding oracle to recover the RSA-wrapped envelope key and decrypt the object. Affected versions are before 3.2.2 and 4.0.x before 4.0.3; the 1.x and 2.x lines are unpatched and must be migrated. Exploitation requires valid credentials, metadata modification permissions, and many decryption queries, so no public exploit identified at time of analysis, consistent with SSVC Exploitation: none.
Amazon SageMaker Python SDK versions V3 before 3.10.0 and V2 before 2.257.3 can write unredacted repository credentials into CloudWatch Logs when a git clone invoked through runclone_command() fails. An authenticated remote user with permission to read the relevant CloudWatch Logs can obtain plaintext repository credentials, but the clone operation must fail for the disclosure to occur. No public exploit identified at time of analysis, and vendor-released patches are available in V3 3.10.0 and V2 2.257.3.
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.
Information disclosure in AWS CDK's core library (aws-cdk-lib) before 2.267.0 allows a context-dependent actor to cause files from the build host to be published as a deployed asset through improper symbolic-link resolution during asset bundling. Exploitation is local to the build environment and requires the victim to actually run the bundling/synth step (UI:P) on a directory whose contents the attacker can influence, so a developer or CI pipeline must consume untrusted asset sources for the issue to trigger. No public exploit code or confirmed active exploitation has been identified at time of analysis; the primary risk is unintended disclosure of build-host files (for example credentials or configuration) into a deployed stack. Vendor-released patch: 2.267.0, which changes bundling to throw on external symlinks via SymlinkFollowMode.BLOCK_EXTERNAL.
World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.
Server-side request forgery in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit versions before 0.3.14 allows an authenticated actor within the same AWS account to make the environment of a user importing a Bedrock Agent issue arbitrary outbound requests and read arbitrary local files. The attacker must supply crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group, and exploitation requires the victim to actively import that agent; this narrow interaction requirement and the same-account authentication prerequisite limit the practical exposure, consistent with the vendor's Medium (CVSS 4.0 5.7) rating and our assessed CVSS 3.1 score of AV:N/AC:L/PR:L/UI:R with high confidentiality impact only. No public exploit code has been identified at time of analysis, and no known active exploitation has been reported.
Cross-account secret replication in devopspolis secrets-replicator up to and including 0.4.0 silently drops the configured External ID, so the confused-deputy safeguard that operators believe protects the destination role is never actually enforced. An attacker who already holds or can influence an AWS principal that is permitted to assume the destination role (CVSS PR:L, requiring some standing in the trust relationship) can therefore assume it without supplying the External ID, resulting in incorrect permission assignment and limited confidentiality and integrity impact (CVSS 5.3, CWE-732). The flaw affects only deployments that use cross-account AssumeRole replication and rely on external_id for isolation; single-account deployments and configurations that never used an External ID are not impacted. Patches ship in v0.5.0 (commit b42239405fbf4fae3c3f0048fc0b4225112edceb) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
Arbitrary file creation, overwrite, and truncation outside the intended workspace is possible on hosts running AWS security-agent-mcp-server before version 0.2.0, because the diff scan operation injects an attacker-controlled 'reference' value as extra command arguments. The flaw is local (AV:L) and requires the operator or AI agent to run the diff scan against attacker-influenced input (UI:R), but no authentication is needed once that operation is invoked (PR:N) and the impact crosses a security boundary (S:C), yielding high integrity and availability impact with no confidentiality loss (CVSS 8.2, High). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is version 0.2.0.
Argument injection in the AWS EFS CSI Driver v3.1.0 through v3.4.2 allows an authenticated Kubernetes user or service account that already holds PersistentVolume creation permissions to smuggle extra mount options into an EFS mount by embedding comma-separated tokens in a PersistentVolume's mounttargetipmap volumeAttribute. Because the driver fails to neutralize the argument delimiter, injected tokens are parsed as additional mount flags, giving high confidentiality and integrity impact along the container storage path, while availability is not affected under the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (6.5). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped v3.5.0 to remove the condition.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
XML External Entity (XXE) injection in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper 3.3.0-4.2.0 allows an actor with write access to the shared cache infrastructure to exfiltrate sensitive files - including database credentials and IAM role credentials - from any application host that reads poisoned cached query results. The attack is conditioned on the RemoteQueryCachePlugin being enabled and the application caching XML column types (SQLXML); an adversary with cache write access injects crafted XML containing external entity references into a cached column value, which are resolved when the application deserializes the cached result. Amazon released version 4.3.0 on 2026-07-23 to fix the issue; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.
Code execution inside the target SageMaker execution environment, together with disclosure of the execution role's IAM credentials, is reachable through the Amazon SageMaker Python SDK's default_bucket() helper, which provisions and then consumes an S3 bucket whose name is derived predictably from the account ID and region but never verifies who actually owns that bucket. The defect affects V3 releases before 3.10.0 and V2 releases before 2.257.3; a remote actor who registers that predictable bucket name in their own AWS account first can influence the artifacts, scripts and data the victim's training, processing and hosting jobs read and write, which the vendor scores 9.4 (Critical) under CVSS 4.0 and which our independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attacker must win a bucket-name pre-creation race. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation favors newly onboarded or not-yet-provisioned environments, since targets that already own their default bucket are not exposed.
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Amazon Neptune engine versions prior to 1.5.0.0 contain a deserialization flaw in the Gremlin graph data import component that lets an authenticated remote actor holding standard database permissions execute arbitrary code and reach internal service credentials. Exploitation requires working database credentials and network access to the Gremlin import interface, so exposure is greatest in multi-user, multi-tenant, or lower-trust deployments where untrusted parties hold standard DB accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high CVSS 4.0 score (9.4) and our independent CVSS 3.1 assessment (8.8, scope-changed, high confidentiality/integrity/availability impact) confirm this is a genuine high-priority issue rather than a CVSS-inflated one. Vendor-released patches are available as engine version 1.5.0.0 with backports to 1.4.8.1 and 1.4.7.1, and clusters enrolled in auto-update may be remediated without operator action.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Arbitrary code execution in AWS Bedrock AgentCore Starter Toolkit before 0.3.14 allows an authenticated same-account actor to inject malicious Python code into generated agent source by importing a crafted Bedrock Agent configuration, which executes when the victim runs or deploys the agent. Exploitation requires the victim to import and then run or deploy the agent, and the actor must have valid same-account credentials. No public exploit identified at time of analysis; remediation requires upgrading to 0.3.14 and re-importing any previously affected agents because the generated source persists.
Authorization bypass in the optional Amazon Q Business Lambda hook sample shipped alongside QnABot on AWS 7.0.0 through 7.4.5 lets an authenticated remote user cause the hook to read arbitrary Amazon S3 objects in the deploying AWS account, exposing data the caller should not be able to reach. Only customers who separately and manually deployed the q-business-lambda-hook sample stack on top of an affected QnABot version are exposed; the hook is not installed by default and the impact is limited to confidentiality within that account. Vendor-released patch: 7.4.6, and no public exploit identified at time of analysis. Per the authoritative assessment this is a moderate, conditional risk rather than a widespread emergency, because exploitation depends on the optional component being present, on authenticated access to the hook's request path, and the resulting impact is S3 object read only.
OS command injection in the Studio Space startup validation script of Amazon SageMaker Distribution (2.x, 3.x, and 4.x lines, as used by Amazon SageMaker Unified Studio) allows an authenticated remote user with project contributor permissions to execute arbitrary commands inside another project member's Studio Space and steal that member's temporary execution-role credentials via a crafted connection resource property. Exploitation is a shared/multi-tenant insider or compromised-collaborator scenario rather than unauthenticated external access, and it is additionally gated by user interaction because the victim's Studio Space must start and run the vulnerable startup script for the injected command to reach that member. No public exploit identified at time of analysis; vendor-released patches exist for supported lines, and end-of-support minor lines will not receive a fix.
Server-side request forgery in Loom for AWS before 1.7.0 lets an authenticated user with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) supply a crafted connection address that the backend fetcher follows and whose response body it echoes back, exposing the application container's own IAM role credentials and responses from arbitrary internal network locations. Exploitation requires a high-privileged authenticated account (CVSS PR:H) and is only meaningful where the container runs with a role worth stealing; there is no anonymous or pre-authentication path, and no public exploit identified at time of analysis. Deployments on or upgraded to 1.7.0, which adds IP-validated, DNS-pinned fetchers and connection-sink guards, are not affected.
Server-side request forgery in the OAuth2 discovery handling of Loom for AWS (awslabs/loom) before 1.7.0 lets an authenticated user who can register a tool server or remote agent supply a crafted discovery document address, causing the backend to make requests to arbitrary internal network locations and - in deployments using delegated authentication - to leak another user's access token. The prerequisites are meaningful: the attacker needs high privileges to register the tool server/remote agent (PR:H) and the token-disclosure outcome requires passive interaction from a victim user (UI:P), so this is a credible, above-average-priority issue rather than an emergency, and it only affects deployments actually using the OAuth2/OIDC delegated-authentication discovery feature. There is no public exploit identified at time of analysis; the vendor has released Loom 1.7.0, which adds a deployment-trusted issuer host requirement before any token exchange and applies an IP-validated, DNS-pinned fetcher to all outbound OAuth2/OIDC calls.
Loom for AWS deployments running a version before 1.6.1 with no identity provider configured expose an unauthenticated super-admin takeover of the agent control plane, allowing any remote party to register tool servers, read stored integration credentials, and rewrite the IAM role policies attached to managed agent roles simply by sending requests to the application API; no credentials, user interaction, or crafted payload are required. The flaw is a missing-authentication-for-critical-function (CWE-306) defect in the authentication dependency, where the local-development bypass intended for environments without Cognito/OIDC activated automatically for every request instead of failing closed. Exploitation is conditional on that IdP-less configuration, so environments with a properly configured identity provider are not reachable through this path; a vendor patch ships in 1.6.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Deserialization of untrusted data in the GluonTS model-loading component allows arbitrary OS command execution with the privileges of the loading process when a victim loads a crafted serialized model directory in versions before 0.17.0. The flaw is scored 8.4 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication is required but exploitation is local and depends on a user actively loading the malicious model artifact; the attacker must first place that artifact in the victim's load path (untrusted model hub, shared directory, or compromised pipeline), and environments that only load self-generated trusted models are not affected. AWS has released a fix in GluonTS 0.17.0 (upstream PR #3304, '[Security] Resolve security issue for torch.load'), and no public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS data was not provided for this CVE.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 through 1.6.0 running on Python 3.7 and later allows an adversary-in-the-middle who possesses a certificate issued for an unrelated hostname by a certificate authority already in the device trust store to impersonate the AWS IoT Core endpoint, read device telemetry, and inject MQTT messages that the device processes as authentic. This is not exploitable from an arbitrary internet location: the attacker must hold an on-path position and a trusted-CA certificate for an unrelated hostname. No public exploit was identified at time of analysis, and the vendor has released 1.6.1 to enforce hostname verification.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Incorrect privilege assignment in the AWS Temporary Elevated Access Management (TEAM) solution for IAM Identity Center (all versions before 1.5.1) permits any authenticated application user to read, approve, modify, or revoke arbitrary access requests - effectively enabling self-approval of elevated permissions to AWS accounts managed by the TEAM deployment. The root cause is an improperly scoped Cognito Identity Pool that fails to enforce authorization boundaries between regular requesters and privileged approvers or administrators, compounded by client-side derivation of account names and roles. No public exploit has been identified at time of analysis, and SSVC rates exploitation status as none.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
SSRF in AWS Systems Manager Agent's port-forwarding feature allows an authenticated remote user to bypass the link-local address denylist and reach the EC2 Instance Metadata Service (IMDS), enabling theft of the managed instance's temporary IAM role credentials. The bypass exploits insufficient canonicalization of IP addresses before denylist evaluation - alternate representations of 169.254.169.254 (hex, decimal, IPv6-mapped, etc.) pass the check unblocked. With stolen credentials, the attacker can exercise the instance's full IAM role permissions from outside the instance. No public exploit identified at time of analysis, but the release notes confirm the fix explicitly canonicalizes IPs and extends the denylist to include ECS/EKS credential endpoints.
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on the host of a self-managed PostgreSQL server, even in the server's default read-only mode. The read-only enforcement in the SQL validation component fails to reject PostgreSQL's COPY ... TO PROGRAM construct, so a crafted statement embedded in content processed when an authenticated user interacts with the MCP server executes shell commands on the database host. No public exploit identified at time of analysis; the flaw is fixed in 1.1.7 and documented in AWS bulletin 2026-104 and GHSA-fph8-pg5w-78fv.
Privilege escalation to root in the AWS FPGA Development Kit (aws-fpga) before version 2.3.4 is achievable when a local low-privileged user pre-places malicious shell content at the predictable path `/tmp/sdk_root_env.exp`, which the `sdk_setup.sh` installation script sources after elevating its own privileges. The root cause (CWE-379) is the installation component writing a shell function file to the world-writable `/tmp` directory without using secure temporary file practices, making the path guessable and controllable by any local account. Amazon released a fix in v2.3.4 that removes the offending write step entirely, sourcing the function directly from `shared/bin/set_common_functions.sh` instead; no public exploit has been identified at time of analysis.
OS command injection in the Amazon Web Services codecatalyst-blueprints npm package (before 0.3.156) allows a repository contributor with commit access to execute arbitrary commands inside the blueprint resynthesis environment by embedding shell metacharacters in the `owner` field of a `[local]` merge strategy entry within a crafted `.ownership-file`. The attack requires both commit access to a project repository and a resynthesis trigger event, making automated mass exploitation infeasible. No public exploit has been identified and SSVC rates exploitation as none and non-automatable; users of the managed Amazon CodeCatalyst service require no action because AWS applies independent server-side allowlist enforcement and per-project environment isolation.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. Vendor-released patch is available at version 3.8.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. Affected products span both self-hosted OpenSearch Dashboards (all versions per CPE) and Amazon OpenSearch Service. The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low attack complexity and no authentication prerequisite, making any network-exposed instance potentially reachable. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. No public exploit code has been identified at time of analysis, but the network-reachable RCE primitive, low complexity, and low privilege requirement collectively make this a high-priority remediation target; vendor patches are available in OpenSearch 3.7.0 and 2.19.6.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's `non_interactive` parameter to `true`, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration in Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 allows a remote unauthenticated attacker - operating through prompt injection - to redirect RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint by supplying a crafted broker hostname in the MCP client context. The RabbitMQ broker connection tools fail to validate that hostnames resolved through the MCP client context correspond to legitimate Amazon MQ broker endpoints, enabling a server-side request forgery-like exfiltration primitive. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the vendor (Amazon) has released a confirmed fix in version 2.0.24.
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary commands inside the Code Interpreter sandbox by embedding shell/argument delimiters in package names passed to install_packages(). Because the CVSS vector is PR:L, an attacker needs some level of authenticated access and the flaw requires user interaction (UI:A) with a high confidentiality and integrity impact (CVSS 4.0 base 8.4). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated attackers exhaust server sockets and async tasks by opening many connections and trickling partial requests that never complete. The default serve() path ships without connection read/header timeouts or a concurrent-connection cap, so a classic slowloris-style flood can hang the service indefinitely. No public exploit has been identified at time of analysis, though the technique is well-understood and the CVSS 4.0 base score is 8.7 (High).
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Server-side request forgery in AWS awslabs.healthlake-mcp-server before 0.0.14 lets a remote authenticated user exfiltrate AWS temporary security credentials to an attacker-controlled endpoint by supplying a crafted next_token pagination parameter. Because the server never validates that paginated request URLs still point at the legitimate HealthLake FHIR datastore, subsequent authenticated calls (carrying SigV4/temporary credentials) can be redirected off-host. Rated CVSS 4.0 9.2 (critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file disclosure in AWS Research and Engineering Studio (RES) prior to version 2026.06 allows an authenticated remote user to read any file readable by root on the cluster-manager EC2 instance. The Auth.GetUserPrivateKey API follows a user-controlled symbolic link at ~/.ssh/id_rsa, and because the cluster-manager process runs as root, an attacker can exfiltrate other users' SSH private keys and application secrets. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Amazon (agentic-community) mcp-gateway-registry before 1.0.13 allows an authenticated remote user to execute arbitrary SQL queries by supplying a crafted table_name that the metrics-service retention policy component interpolates directly into SQL in identifier position. Because the injection sits in an identifier (table name) position rather than a parameterizable value, it bypasses ordinary prepared-statement protections and grants broad read/write access to the metrics datastore. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; a vendor patch (v1.0.13) is available.
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
OS command injection in AWS aws-cdk-lib lets an actor who controls a dependency version string in a project's package.json run arbitrary commands on the host executing the CDK toolchain. The flaw lives in the OsCommand helper of the NodejsFunction Docker bundling pipeline, which passes unsanitized version strings into a shell during nodeModules installation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; AWS has released a fixed version (v2.260.0).
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an HTTP/2 request body across multiple frames so that only a partial body is inspected before reaching the backend. The flaw (CWE-444, HTTP request smuggling) affects only ALB target groups serving HTTP/2 traffic with AWS WAF enabled, and lets attackers slip malicious payloads past WAF managed rules. No public exploit identified at time of analysis and it is not on CISA KEV; AWS scores it 7.9 (CVSS 4.0) with impact falling on the protected backend rather than the ALB itself.
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies past managed rule inspection by fragmenting the HTTP/2 request body across frames so only a partial body is examined. The flaw (CWE-444, request smuggling) defeats the protective security control rather than CloudFront itself, allowing attacks the WAF would normally block to reach the protected origin. AWS remediated it server-side with no customer action required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Command injection in the AWS Bedrock AgentCore Python SDK (versions >= 1.1.3, < 1.6.1) allows remote authenticated users to execute arbitrary commands within the Code Interpreter sandbox by supplying crafted package name arguments to the install_packages() method. The flaw stems from improper neutralization of argument delimiters (CWE-88), letting attacker-controlled strings break out of the intended pip-install argument context. No public exploit identified at time of analysis, but a vendor patch and advisory are available from AWS.
Client-side memory corruption in the AWS Common Runtime aws-c-http library can be triggered by a malicious HTTP/2 server that sends a crafted sequence of HEADERS frames manipulating the HPACK dynamic table size, potentially leading to arbitrary code execution in applications that use the library as an HTTP/2 client. The CVSS 4.0 score of 8.7 (High) reflects network reachability with low complexity but requires user/client interaction (initiating a connection to the attacker server). There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows) allows an actor controlling bundling property values (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via shell metacharacter injection. The flaw, reported by Amazon and tracked under GHSA-999r-qq7v-r334, affects developer and CI/CD machines synthesizing CDK applications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via crafted collaborationInstruction strings stored on Bedrock Agent collaborators. When another user in the same AWS account imports the agent, the malicious triple-quote payload breaks out of the generated Python docstring and executes attacker-controlled code on AWS AgentCore Runtime under the imported agent's IAM execution role, as well as on the importing user's local environment. No public exploit identified at time of analysis, but the cross-user, cross-environment scope and 9.0 CVSS rating make this a high-priority patch.
Privilege escalation in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (GlobalDatabasePlugin) allows an authenticated low-privilege RDS user to gain the privileges of another user — including rds_superuser — by planting a malicious function on an untrusted search path that executes when the targeted user connects through the wrapper. The flaw is rated CVSS 4.0 8.6 (High) and requires user interaction (the victim must initiate a connection via the wrapper), with no public exploit identified at time of analysis. A vendor patch is available in release 2026-05-26.
Privilege escalation in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL (versions prior to 4.0.1) allows a remote authenticated low-privilege RDS user to gain the privileges of another database user - including rds_superuser - by planting a crafted function that executes when the higher-privileged user connects to the cluster through the affected wrapper. No public exploit identified at time of analysis, and the vendor (Amazon) released a fix in version 4.0.1 on 2026-05-13 that fully qualifies function calls in PostgreSQL topology detection queries to close the search-path attack surface.
Information disclosure in AWS Graph Explorer before v3.0.1 occurs because the bundled proxy server silently falls back to plaintext HTTP when its TLS certificate files cannot be loaded, causing requests intended for HTTPS to traverse the network unencrypted. Network-positioned attackers can intercept these requests and harvest sensitive graph queries, headers, or credentials. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Arbitrary command execution in Amazon Kiro IDE versions prior to 0.11 allows remote attackers to plant malicious task definitions (e.g., .vscode/tasks.json) via the IDE's file write tool, which then auto-execute when a developer opens the affected workspace folder. The CVSS 4.0 score of 8.6 reflects network-reachable abuse with high confidentiality, integrity, and availability impact contingent on a single user action (folder open). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in the Amazon Braket Python SDK (versions 1.10.0 up to but not including 1.117.0) lets a remote authenticated actor with S3 write access to a Braket job output bucket run code on any machine that later processes those job results. The SDK reads the untrusted dataFormat field from results.json and, when it is set to pickled_v4, feeds attacker-controlled data into pickle.loads(), executing code with the victim SDK user's permissions. There is no public exploit identified at time of analysis, EPSS is low (0.32%), and CISA SSVC rates exploitation as none, but the technical impact is total.
Authorization bypass in AWS Kiro CLI versions prior to 1.28.0 allows a local attacker to invoke arbitrary tools, including shell commands, without triggering the user approval prompt by piping crafted content through stdin. Reported by Amazon (AMZN) and tagged as an Authentication Bypass, this issue has a vendor-released fix in 1.28.0; publicly available exploit code exists is not indicated, and the SSVC framework currently records no observed exploitation despite a Total technical impact rating.
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible to the RabbitMQ process by submitting a crafted arn:aws-debug:file scheme to the PUT /api/aws/arn/validate validation endpoint. The flaw stems from leftover debug code in the ARN resolver and was reported by AWS itself; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in the amazon-redshift-python-driver (versions prior to 2.1.14) allows a malicious or compromised Redshift server, or a man-in-the-middle attacker positioned on the network path, to execute arbitrary Python code on any client that connects. The root cause is unsafe use of Python's eval() against untrusted server-supplied data inside the vector_in() function. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and PR:N/UI:N vector make this a high-priority client-side supply-chain-style risk.
Cleartext HMAC signing key exposure in Amazon SageMaker Python SDK versions <2.257.2 and <3.8.0 enables authenticated attackers with SageMaker describe API and S3 write permissions to forge model artifact integrity signatures and achieve remote code execution in inference containers. AWS released patches in v2.257.2 and v3.8.0 with security fixes addressing Triton HMAC key exposure and missing integrity checks. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting limited exploitation activity despite high CVSS score.
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to execute arbitrary shell commands with SYSTEM privileges on the underlying host. The vulnerability exists in the FSx Windows File Server volume mounting component (versions prior to 1.103.0), where username field input is not properly sanitized before being passed to OS commands. This affects AWS customers running Windows-based ECS container workloads with FSx volumes - exploitation requires IAM permissions to register ECS task definitions or write to credential stores (Secrets Manager/SSM Parameter Store) used by FSx configurations. Vendor-released patch: version 1.103.0. EPSS and KEV data not provided; no public exploit identified at time of analysis.
Checksum and size-validation bypass in Amazon's FreeRTOS-Plus-TCP stack (versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0) lets an adjacent-network attacker inject malformed packets by spoofing the Ethernet source MAC to match one of the device's own registered endpoint MACs, causing the loopback-detection path to skip all input validation. This is a CWE-290 spoofing/authentication-bypass flaw carrying a CVSS 4.0 base of 7.1 with integrity-only impact and no confidentiality or availability loss. No public exploit identified at time of analysis, EPSS is 0.02% (4th percentile), and CISA SSVC rates exploitation as none and automatable as no, so real-world urgency is modest despite the medium-high score.
Arbitrary code execution in AWS QnABot on AWS (versions 7.2.4 and earlier) allows an authenticated administrator to break out of the intended expression sandbox by abusing the static-eval npm package. By injecting a crafted conditional chaining expression through the Content Designer interface, an admin escapes the sandbox via JavaScript prototype manipulation and runs code inside the fulfillment Lambda, reaching backend resources not normally exposed. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%), consistent with the SSVC assessment that no exploitation has been observed.
Path traversal vulnerabilities in AWS Tough (a Rust TUF client library) versions prior to 0.22.0 enable authenticated users with delegated signing privileges to write arbitrary files outside intended repository directories, bypassing incomplete fixes from previous security patches. The flaws exist in three distinct code paths: absolute target names in copy_target/link_target operations, symlinked parent directories in save_target, and symlinked metadata filenames in SignedRole::write. AWS has released patches in tough-v0.22.0 and tuftool-v0.15.0 that implement post-resolution path containment verification. No public exploit code or active exploitation confirmed at time of analysis, though CVSS 7.1 HIGH reflects significant integrity impact when exploited.
Metadata integrity bypass in AWS tough (TUF client library) before v0.22.0 allows authenticated users with delegated signing authority to poison local metadata caches by bypassing expiration, hash, and length validation checks. The vulnerability exists because load_delegations skips specification-mandated integrity checks applied to top-level targets metadata, enabling malicious delegated signers to inject invalid metadata. AWS has released patches in tough-v0.22.0 and tuftool-v0.15.0. CVSS 7.1 reflects network vector but high attack complexity (AT:P indicates specialized conditions). No public exploit or active exploitation confirmed at time of analysis, though authentication bypass tag suggests significant trust boundary violation.
Signature duplication in AWS Tough TUF client prior to v0.22.0 allows authenticated attackers to bypass threshold signature requirements for delegated role metadata by reusing a single valid signature multiple times. The flaw undermines TUF's multi-signature integrity model, enabling acceptance of forged metadata with reduced cryptographic validation. Vendor patch available (tough-v0.22.0, tuftool-v0.15.0). No public exploit code or active exploitation confirmed at time of analysis, but CVSS 7.0 reflects high integrity impact to both vulnerable and downstream systems.
Authenticated users with low privileges can escalate to deployment admin in AWS Ops Wheel (pre-PR #165) by manipulating the custom:deployment_admin attribute through crafted UpdateUserAttributes API calls to Cognito User Pool. This privilege escalation allows full control over Cognito user account management and deployment administration. Upstream fix available via GitHub PR #165; AWS security bulletin AMZN-2026-018 confirms patch availability. No active exploitation confirmed (not in CISA KEV), but CVSS 8.7 reflects critical impact across confidentiality, integrity, and availability.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Remote command injection in AWS Research and Engineering Studio (RES) 2024.10 through 2025.12.01 allows authenticated users to execute arbitrary commands on cluster-manager EC2 instances through unsanitized input in the FileBrowser API. Vendor-released patch available (version 2026.03). No public exploit identified at time of analysis, though CVSS 7.7 reflects high impact if exploited by low-privileged authenticated users with network access.
Privilege escalation in AWS Research and Engineering Studio (RES) versions prior to 2026.03 allows authenticated remote attackers to assume virtual desktop host instance profile permissions and interact with AWS resources via crafted API requests. The vulnerability stems from unsanitized user-modifiable attributes in session creation. CVSS 8.7 (High) with network attack vector, low complexity, and requiring low privileges. Vendor-released patch available (version 2026.03). EPSS data not provided; no public exploit identified at time of analysis.
Remote code execution as root in AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01 allows authenticated remote attackers to execute arbitrary OS commands via unsanitized input in virtual desktop session names. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78 command injection), enabling privilege escalation to root on virtual desktop hosts. Vendor-released patch available in version 2026.03. CVSS 8.7 (High) with network attack vector, low complexity, and low privileges required. No public exploit identified at time of analysis, though the technical details in GitHub issue #151 may facilitate weaponization.
Arbitrary code execution in AWS Kiro IDE versions prior to 0.8.140 occurs when a local user opens a maliciously crafted workspace containing an unsanitized color theme name, exploiting improper neutralization of input during webview generation. The attack requires user interaction (trusting the workspace when prompted) and can deliver full system compromise with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though SSVC framework rates technical impact as total with manual (non-automatable) exploitation potential.
Memory corruption leading to arbitrary code execution affects AWS C Event Stream library versions before 0.6.0 when clients process malicious event-stream messages from attacker-controlled servers. The out-of-bounds write vulnerability in the streaming decoder requires high attack complexity and user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but grants complete control over confidentiality, integrity, and availability if successfully exploited. No public exploit identified at time of analysis, with EPSS data unavailable for this 2026-dated CVE. Vendor-released patch version 0.6.0 addresses the issue.
A logic error in AWS-LC's CRL (Certificate Revocation List) distribution point validation causes the cryptographic library to incorrectly reject partitioned CRLs as out of scope, allowing revoked certificates to bypass certificate revocation checks. This authentication bypass vulnerability affects AWS-LC versions before 1.71.0 and AWS-LC-FIPS versions before 3.3.0, potentially allowing attackers to use revoked certificates for unauthorized access to systems that rely on AWS-LC for certificate validation. No active exploitation has been reported in KEV, and no EPSS score is available yet.
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local user opens a maliciously crafted project directory. The vulnerability affects all versions of Kiro IDE prior to 0.8.0 on all supported platforms and bypasses workspace trust protections designed to prevent unauthorized code execution. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability enables remote code execution through local user interaction.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal state. PoC and patch available.
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
Authenticated attackers with read and metadata-write access to encrypted objects in Amazon S3 can force a padding downgrade in the Amazon.Extensions.S3.Encryption .NET client, then use a Bleichenbacher padding oracle to recover the RSA-wrapped envelope key and decrypt the object. Affected versions are before 3.2.2 and 4.0.x before 4.0.3; the 1.x and 2.x lines are unpatched and must be migrated. Exploitation requires valid credentials, metadata modification permissions, and many decryption queries, so no public exploit identified at time of analysis, consistent with SSVC Exploitation: none.
Amazon SageMaker Python SDK versions V3 before 3.10.0 and V2 before 2.257.3 can write unredacted repository credentials into CloudWatch Logs when a git clone invoked through runclone_command() fails. An authenticated remote user with permission to read the relevant CloudWatch Logs can obtain plaintext repository credentials, but the clone operation must fail for the disclosure to occur. No public exploit identified at time of analysis, and vendor-released patches are available in V3 3.10.0 and V2 2.257.3.
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.
Information disclosure in AWS CDK's core library (aws-cdk-lib) before 2.267.0 allows a context-dependent actor to cause files from the build host to be published as a deployed asset through improper symbolic-link resolution during asset bundling. Exploitation is local to the build environment and requires the victim to actually run the bundling/synth step (UI:P) on a directory whose contents the attacker can influence, so a developer or CI pipeline must consume untrusted asset sources for the issue to trigger. No public exploit code or confirmed active exploitation has been identified at time of analysis; the primary risk is unintended disclosure of build-host files (for example credentials or configuration) into a deployed stack. Vendor-released patch: 2.267.0, which changes bundling to throw on external symlinks via SymlinkFollowMode.BLOCK_EXTERNAL.
World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.
Server-side request forgery in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit versions before 0.3.14 allows an authenticated actor within the same AWS account to make the environment of a user importing a Bedrock Agent issue arbitrary outbound requests and read arbitrary local files. The attacker must supply crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group, and exploitation requires the victim to actively import that agent; this narrow interaction requirement and the same-account authentication prerequisite limit the practical exposure, consistent with the vendor's Medium (CVSS 4.0 5.7) rating and our assessed CVSS 3.1 score of AV:N/AC:L/PR:L/UI:R with high confidentiality impact only. No public exploit code has been identified at time of analysis, and no known active exploitation has been reported.
Cross-account secret replication in devopspolis secrets-replicator up to and including 0.4.0 silently drops the configured External ID, so the confused-deputy safeguard that operators believe protects the destination role is never actually enforced. An attacker who already holds or can influence an AWS principal that is permitted to assume the destination role (CVSS PR:L, requiring some standing in the trust relationship) can therefore assume it without supplying the External ID, resulting in incorrect permission assignment and limited confidentiality and integrity impact (CVSS 5.3, CWE-732). The flaw affects only deployments that use cross-account AssumeRole replication and rely on external_id for isolation; single-account deployments and configurations that never used an External ID are not impacted. Patches ship in v0.5.0 (commit b42239405fbf4fae3c3f0048fc0b4225112edceb) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
Arbitrary file creation, overwrite, and truncation outside the intended workspace is possible on hosts running AWS security-agent-mcp-server before version 0.2.0, because the diff scan operation injects an attacker-controlled 'reference' value as extra command arguments. The flaw is local (AV:L) and requires the operator or AI agent to run the diff scan against attacker-influenced input (UI:R), but no authentication is needed once that operation is invoked (PR:N) and the impact crosses a security boundary (S:C), yielding high integrity and availability impact with no confidentiality loss (CVSS 8.2, High). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is version 0.2.0.
Argument injection in the AWS EFS CSI Driver v3.1.0 through v3.4.2 allows an authenticated Kubernetes user or service account that already holds PersistentVolume creation permissions to smuggle extra mount options into an EFS mount by embedding comma-separated tokens in a PersistentVolume's mounttargetipmap volumeAttribute. Because the driver fails to neutralize the argument delimiter, injected tokens are parsed as additional mount flags, giving high confidentiality and integrity impact along the container storage path, while availability is not affected under the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (6.5). No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped v3.5.0 to remove the condition.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
XML External Entity (XXE) injection in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper 3.3.0-4.2.0 allows an actor with write access to the shared cache infrastructure to exfiltrate sensitive files - including database credentials and IAM role credentials - from any application host that reads poisoned cached query results. The attack is conditioned on the RemoteQueryCachePlugin being enabled and the application caching XML column types (SQLXML); an adversary with cache write access injects crafted XML containing external entity references into a cached column value, which are resolved when the application deserializes the cached result. Amazon released version 4.3.0 on 2026-07-23 to fix the issue; no public exploit or CISA KEV listing has been identified at time of analysis.