AWS
Monthly
Credential and infrastructure state disclosure in AWS Security Agent MCP Server (versions ≤0.1.5) is enabled by the server's failure to verify S3 bucket ownership before uploading scan archives: an attacker who pre-registers the expected bucket name - derived from the target's publicly known AWS account ID - in their own account will silently receive every subsequent scan archive, which may contain long-lived credentials, Terraform or CloudFormation state files, and other sensitive workspace artifacts. The attack requires no privileges on the victim's account and only passive user interaction (the victim running a scan), but does require the attacker to act before the victim's first deployment. No public exploit has been identified and this CVE is not listed in CISA KEV; vendor-released patch 0.2.0 adds ownership verification, though Amazon explicitly notes that patching alone does not reclaim a bucket name already seized by a third party.
Bucket-squatting in the AWS Security Agent Plugin (aws-agents-for-devsecops) before 1.1.0 allows a remote unauthenticated attacker to intercept private workspace source archives uploaded during security scans. Because the S3 bucket name is deterministically derived from the victim's AWS account ID and region - both non-secret and frequently exposed in public ARNs, IAM policy documents, and ECR URIs - a third party can pre-register the predictable name in their own AWS account before the victim's setup runs. When a scan is subsequently triggered, the unpatched plugin uploads source.zip (containing source code, credentials, and infrastructure state) to the attacker-controlled bucket without verifying ownership, silently exfiltrating sensitive data. Vendor-released patch: 1.1.0.
Read-only enforcement bypass in Amazon awslabs mysql-mcp-server (versions ≤ 1.0.21) enables context-dependent actors - including AI models or users interacting via the Model Context Protocol - to reach file-read and file-write SQL execution paths that the mutable SQL detector is designed to gate. The detector relies on a regex engine that does not treat SQL inline comments as whitespace, allowing crafted queries containing comment tokens to pass the allowlist check while MySQL parses and executes the full underlying write or file-access statement. No public exploit has been identified at time of analysis; AWS has released a fix in version 1.0.23.
Unverified access-point ownership in the AWS EFS CSI Driver before v3.4.1 enables an authenticated Kubernetes user holding PersistentVolume creation privileges to trigger recursive deletion of directory trees on EFS filesystems they are not authorized to access. The volume deletion component accepts a crafted volumeHandle that cross-pairs an access point from one EFS filesystem with a different target filesystem, and the driver never validates that the access point belongs to the stated filesystem before executing the deletion. No public exploit has been identified at time of analysis, but the technique is mechanically straightforward for any attacker who already holds the required cluster-scoped RBAC rights.
Zip extraction in AWS diagram-as-code (awsdac) versions 0.10 through 0.23 is vulnerable to relative path traversal (CWE-23), enabling a third party to write arbitrary files outside the intended extraction directory by embedding crafted path sequences in zip entry names within a malicious diagram bundle. Exploitation requires user interaction - a victim must actively process the attacker-supplied bundle - making this a social-engineering-dependent local attack. AWS has released a patched version 0.24; no active exploitation or public exploit code has been identified at time of analysis.
Stored cross-site scripting in the OpenSearch Dashboards dashboards-observability plugin allows a remote authenticated user with write permissions to saved objects to inject arbitrary JavaScript that executes in other users' browser sessions. Affected deployments include both self-hosted OpenSearch Dashboards and Amazon OpenSearch Service (managed). The scope change (S:C) and high confidentiality/integrity impact make this particularly dangerous in multi-tenant environments where admin accounts may view attacker-controlled saved assets. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 3.4.0 and 2.19.0.
Remote authenticated users can crash applications built on Amazon aws-sdk-cpp versions before 1.11.862 by supplying crafted Base64-encoded input that triggers an out-of-bounds read in the SDK's Base64 decoder. Exploitation is constrained to authenticated users, requires high attack complexity, and is platform-specific - not all deployments are vulnerable. The CVSS 4.0 vector (VA:H, VC:N, VI:N) confirms impact is limited to availability (denial of service); no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in the Base64 decoder of Amazon's aws-sdk-cpp (all versions before 1.11.862) exposes applications to heap memory corruption or crash when processing attacker-supplied Base64-encoded content. Remote authenticated attackers can trigger the defect by submitting crafted input to any application built on this SDK that routes user-controlled data through the affected decoder path. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, though the CWE-787 heap write class carries inherent tail risk beyond the denial-of-service primary impact.
Path traversal in Amazon's awslabs.aws-transform-mcp-server MCP package (versions 0.1.0-0.1.4) enables a context-dependent actor - which may include a malicious MCP resource, prompt-injected content, or local attacker - to write arbitrary files outside the server's intended working directory by supplying traversal sequences in the savePath parameter of the get_resource tool. The vulnerability carries a CVSS 8.6 (High) score with scope change, meaning exploitation can impact the broader local filesystem beyond the MCP server process itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch (version 0.1.5) is available via PyPI and covered under AWS Security Bulletin 2026-075.
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.
Directory traversal in AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 allows an actor who can influence the MCP agent to write attacker-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory via crafted workflow_files input. All pre-0.0.36 versions are affected, with the integrity-only impact (high) and no confidentiality or availability exposure confirmed by the CVSS 4.0 vector. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; Amazon has released a vendor-confirmed patch in version 0.0.36.
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).
Authentication token cache file exposure in Kiro IDE on macOS and Linux allows any local user to read credentials belonging to other users due to world-readable file permissions (0644) instead of the security-appropriate owner-only permissions (0600). All versions before 0.11.133 are affected on UNIX-based platforms; the vulnerability is confirmed by AWS via security bulletin 2026-045 and has been assigned CWE-276 (Incorrect Default Permissions). No public exploit code has been identified at time of analysis, but exploitation requires no technical sophistication - only filesystem read access on a shared system.
Unbounded memory allocation in the CRYPTO frame reassembler of AWS s2n-quic (all versions before v1.82.0) enables unauthenticated remote actors to degrade service availability by sending crafted QUIC Initial packets. Because QUIC Initial packets are processed prior to handshake completion, no session establishment or authentication is required to trigger the condition. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes this straightforwardly reachable on any exposed s2n-quic endpoint.
Remote authenticated actors with S3 write access can achieve code execution in Amazon SageMaker Triton inference containers by replacing model artifacts with malicious pickle payloads that are deserialized without integrity verification. Affected versions are SDK v2 before v2.257.2 and v3 before v3.8.0. The vulnerability requires high-privilege S3 access to the model artifact path but carries severe impact including arbitrary code execution within inference containers. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer overflow in FreeRTOS-Plus-TCP's IPv6 Router Advertisement parser allows an unauthenticated adjacent network actor to corrupt device memory by sending a crafted RA packet containing an oversized prefix length field exceeding the 128-bit maximum valid for IPv6. Affected versions span two branches: 4.0.0-4.2.5 and 4.3.0-4.4.0, with fixes released as V4.2.6 and V4.4.1 respectively. No public exploit code has been identified, EPSS stands at 0.01% (3rd percentile), and SSVC confirms no active exploitation - making this a patch-priority issue rather than an emergency response.
Denial of service via crafted ICMPv6 Router Advertisement in FreeRTOS-Plus-TCP affects embedded devices running versions 4.0.0-4.2.5 and 4.3.0-4.4.0, crashing the device when a truncated PREFIX_INFORMATION option triggers an out-of-bounds read in the IPv6 RA parser. An adjacent-network attacker with no privileges or user interaction can repeatedly crash affected IoT/embedded devices, causing persistent availability loss. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.01% (3rd percentile), but vendor-confirmed patches exist for both affected branches.
Integer underflow in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers enables an adjacent network attacker to crash any affected embedded or IoT device that has outgoing ping support enabled. The flaw spans two active release branches - 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0 - and can trigger a heap out-of-bounds read of up to approximately 65KB, resulting in device denial of service. No public exploit has been identified and EPSS sits at 0.01% (3rd percentile), but the impact on resource-constrained embedded devices can be severe given their limited fault tolerance.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
AWS API MCP Server versions 0.2.14 through 1.3.9 contain an improper path protection flaw in the no-access and workdir features that allows local attackers to bypass file access restrictions and read arbitrary files accessible to the MCP client application. An attacker with local access and user interaction can exploit this vulnerability to expose sensitive local file contents. Users should upgrade to version 1.3.9 or later to remediate this issue.
Timing side-channel attacks in AWS-LC's AES-CCM decryption implementation allow unauthenticated attackers to infer authentication tag validity through precise timing measurements. The vulnerability affects AWS-LC and related cryptographic libraries across multiple AES-CCM variants (128, 192, and 256-bit), potentially enabling attackers to forge authenticated messages. AWS service customers are unaffected, but applications using AWS-LC directly should upgrade to version 1.69.0 or later.
The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. [CVSS 7.8 HIGH]
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP request paths. [CVSS 7.5 HIGH]
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin management. PoC available.
Craft CMS versions 3.5.0-4.16.17 and 5.0.0-RC1-5.8.21 contain a server-side request forgery vulnerability in the save_images_Asset GraphQL mutation that allows authenticated users to bypass hostname validation and retrieve internal URLs by specifying domains resolving to private IP addresses. By uploading files with non-image extensions like .txt, attackers can bypass downstream validation to access sensitive data including AWS instance metadata credentials from the host system. Public exploit code exists for this vulnerability, though patches are available in versions 4.16.18 and 5.8.22.
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. [CVSS 4.3 MEDIUM]
BLUVOYIX's email sending API contains design flaws that permit unauthenticated attackers to send arbitrary emails on behalf of affected organizations through specially crafted HTTP requests. This integrity issue requires no user interaction and could enable large-scale spam or phishing campaigns originating from compromised systems. No patch is currently available for this vulnerability.
AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input fie...
Forged plaintext can be substituted for legitimate decryption output in the Amazon S3 Encryption Client for Go (versions up to and including v3.1) when an application stores the encrypted data key (EDK) in an external "Instruction File" instead of the S3 object's metadata record. An attacker who holds write/upload permission to the target bucket can replace that instruction file with a rogue EDK that decrypts the same underlying ciphertext into attacker-chosen content, exploiting the "Invisible Salamanders" property of a non-committing AEAD, so later reads by the victim client return valid-looking but forged data; the impact is integrity-only (no confidentiality or availability loss) and the default metadata-record storage path is not vulnerable. Amazon shipped key commitment in v4.0.0 on 2025-12-16, EPSS is only 0.11% (1st percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect decryption of client-side encrypted S3 objects in AWS SDK for Ruby versions through 1.207.0 allows an authenticated attacker with PutObject permission on the target S3 bucket to replace the encrypted data key (EDK) stored in an S3 instruction file with a rogue EDK that decrypts the same ciphertext to attacker-chosen plaintext. Exploitation requires the application to use the S3 Encryption Client's optional instruction-file mode for EDK storage rather than S3 object metadata; AWS has released a fix in aws-sdk-s3 1.208.0. EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis, making this a low-urgency, highly conditional cryptographic weakness rather than an immediate threat.
Privilege escalation in Harmonix on AWS framework deployments v0.3.0 through v0.4.1 allows an authenticated IAM principal within the same AWS account to assume an overly-permissive EKS environment provisioning role with administrative privileges, due to the default trust policy granting sts:AssumeRole to the account root principal. Exploitation is limited to in-account actors who already possess sts:AssumeRole permission, and does not affect versions v0.4.2 or later or hardened configurations; no public exploit identified at time of analysis. Vendor-released patch: Harmonix on AWS v0.4.2.
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue arbitrary server-side HTTP requests to internal endpoints, including the AWS Instance Metadata Service at 169.254.169.254. By injecting custom headers that defeat IMDSv2 session-token enforcement, an attacker can pull temporary IAM credentials for the EKS node role when Typebot runs on an EKS node in AWS, escalating a single low-privilege account into full Kubernetes cluster and AWS infrastructure compromise. Publicly available exploit code exists, though EPSS remains low (0.06%, 18th percentile) and the credential-theft outcome only applies to AWS/EKS deployments where IMDS is reachable from the application; version 3.13.1 contains the fix.
Improper verification of AWS EC2 instance identity documents in go-witness (through 0.8.6) and witness (through 0.9.2) allows a forged attestation to be accepted as valid: the AWS attestor reports successful signature verification when the signature is missing or empty, and also when RSA verification of the document fails outright. Addresses: only deployments actually using the AWS attestor are affected, and an attacker must supply or intercept instance identity document data - realistically via Instance Metadata Service (IMDS) impersonation or a man-in-the-middle position against the metadata endpoint, the attack pattern described in AWS Security Bulletin aws-2025-021. Impact is limited to attestation trust/integrity (no code execution, no data disclosure), rated medium severity (CVSS 4.0 base 6.9; assessor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N); no public exploit code has been identified at time of analysis (EPSS ~0.20%, 9th percentile), and the issue is fixed in go-witness 0.9.1 and witness 0.10.1.
Local privilege escalation in AWS VPN Client for macOS versions 1.3.2 through 5.2.0 allows an authenticated, non-administrator local user to gain root code execution by planting a symbolic link in the client's log destination directory and injecting crafted content via client API calls, which is then executed during log rotation under elevated privileges. The flaw is confined to macOS and requires a pre-existing local account, so remote exploitation is not possible; no public exploit code has been identified at time of analysis. AWS has released version 5.2.1 as the complete fix.
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side Request Forgery attacks through the Amazon S3 Connector module, enabling resource location spoofing that could result in unauthorized access to internal systems and data exfiltration. Versions before 2025.1.3, 2024.2.12, and 2023.3.19 are affected. EPSS score of 0.04% (12th percentile) indicates minimal observed exploitation activity, and no public exploit has been identified at time of analysis.
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Credential and infrastructure state disclosure in AWS Security Agent MCP Server (versions ≤0.1.5) is enabled by the server's failure to verify S3 bucket ownership before uploading scan archives: an attacker who pre-registers the expected bucket name - derived from the target's publicly known AWS account ID - in their own account will silently receive every subsequent scan archive, which may contain long-lived credentials, Terraform or CloudFormation state files, and other sensitive workspace artifacts. The attack requires no privileges on the victim's account and only passive user interaction (the victim running a scan), but does require the attacker to act before the victim's first deployment. No public exploit has been identified and this CVE is not listed in CISA KEV; vendor-released patch 0.2.0 adds ownership verification, though Amazon explicitly notes that patching alone does not reclaim a bucket name already seized by a third party.
Bucket-squatting in the AWS Security Agent Plugin (aws-agents-for-devsecops) before 1.1.0 allows a remote unauthenticated attacker to intercept private workspace source archives uploaded during security scans. Because the S3 bucket name is deterministically derived from the victim's AWS account ID and region - both non-secret and frequently exposed in public ARNs, IAM policy documents, and ECR URIs - a third party can pre-register the predictable name in their own AWS account before the victim's setup runs. When a scan is subsequently triggered, the unpatched plugin uploads source.zip (containing source code, credentials, and infrastructure state) to the attacker-controlled bucket without verifying ownership, silently exfiltrating sensitive data. Vendor-released patch: 1.1.0.
Read-only enforcement bypass in Amazon awslabs mysql-mcp-server (versions ≤ 1.0.21) enables context-dependent actors - including AI models or users interacting via the Model Context Protocol - to reach file-read and file-write SQL execution paths that the mutable SQL detector is designed to gate. The detector relies on a regex engine that does not treat SQL inline comments as whitespace, allowing crafted queries containing comment tokens to pass the allowlist check while MySQL parses and executes the full underlying write or file-access statement. No public exploit has been identified at time of analysis; AWS has released a fix in version 1.0.23.
Unverified access-point ownership in the AWS EFS CSI Driver before v3.4.1 enables an authenticated Kubernetes user holding PersistentVolume creation privileges to trigger recursive deletion of directory trees on EFS filesystems they are not authorized to access. The volume deletion component accepts a crafted volumeHandle that cross-pairs an access point from one EFS filesystem with a different target filesystem, and the driver never validates that the access point belongs to the stated filesystem before executing the deletion. No public exploit has been identified at time of analysis, but the technique is mechanically straightforward for any attacker who already holds the required cluster-scoped RBAC rights.
Zip extraction in AWS diagram-as-code (awsdac) versions 0.10 through 0.23 is vulnerable to relative path traversal (CWE-23), enabling a third party to write arbitrary files outside the intended extraction directory by embedding crafted path sequences in zip entry names within a malicious diagram bundle. Exploitation requires user interaction - a victim must actively process the attacker-supplied bundle - making this a social-engineering-dependent local attack. AWS has released a patched version 0.24; no active exploitation or public exploit code has been identified at time of analysis.
Stored cross-site scripting in the OpenSearch Dashboards dashboards-observability plugin allows a remote authenticated user with write permissions to saved objects to inject arbitrary JavaScript that executes in other users' browser sessions. Affected deployments include both self-hosted OpenSearch Dashboards and Amazon OpenSearch Service (managed). The scope change (S:C) and high confidentiality/integrity impact make this particularly dangerous in multi-tenant environments where admin accounts may view attacker-controlled saved assets. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 3.4.0 and 2.19.0.
Remote authenticated users can crash applications built on Amazon aws-sdk-cpp versions before 1.11.862 by supplying crafted Base64-encoded input that triggers an out-of-bounds read in the SDK's Base64 decoder. Exploitation is constrained to authenticated users, requires high attack complexity, and is platform-specific - not all deployments are vulnerable. The CVSS 4.0 vector (VA:H, VC:N, VI:N) confirms impact is limited to availability (denial of service); no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds write in the Base64 decoder of Amazon's aws-sdk-cpp (all versions before 1.11.862) exposes applications to heap memory corruption or crash when processing attacker-supplied Base64-encoded content. Remote authenticated attackers can trigger the defect by submitting crafted input to any application built on this SDK that routes user-controlled data through the affected decoder path. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, though the CWE-787 heap write class carries inherent tail risk beyond the denial-of-service primary impact.
Path traversal in Amazon's awslabs.aws-transform-mcp-server MCP package (versions 0.1.0-0.1.4) enables a context-dependent actor - which may include a malicious MCP resource, prompt-injected content, or local attacker - to write arbitrary files outside the server's intended working directory by supplying traversal sequences in the savePath parameter of the get_resource tool. The vulnerability carries a CVSS 8.6 (High) score with scope change, meaning exploitation can impact the broader local filesystem beyond the MCP server process itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch (version 0.1.5) is available via PyPI and covered under AWS Security Bulletin 2026-075.
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.
Directory traversal in AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 allows an actor who can influence the MCP agent to write attacker-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory via crafted workflow_files input. All pre-0.0.36 versions are affected, with the integrity-only impact (high) and no confidentiality or availability exposure confirmed by the CVSS 4.0 vector. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; Amazon has released a vendor-confirmed patch in version 0.0.36.
SQL injection in the Azure Synapse connector of Amazon aws-athena-query-federation allows authenticated remote users to exfiltrate unintended data from connected Azure Synapse databases by supplying crafted table names that are improperly neutralized before inclusion in SQL commands. Affected versions span v2022.20.1 through v2026.19.1, and the scope of data exposure extends beyond Athena itself into the downstream Synapse database. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid Athena credentials with sufficient privilege to invoke the Synapse connector.
Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.
Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).
Authentication token cache file exposure in Kiro IDE on macOS and Linux allows any local user to read credentials belonging to other users due to world-readable file permissions (0644) instead of the security-appropriate owner-only permissions (0600). All versions before 0.11.133 are affected on UNIX-based platforms; the vulnerability is confirmed by AWS via security bulletin 2026-045 and has been assigned CWE-276 (Incorrect Default Permissions). No public exploit code has been identified at time of analysis, but exploitation requires no technical sophistication - only filesystem read access on a shared system.
Unbounded memory allocation in the CRYPTO frame reassembler of AWS s2n-quic (all versions before v1.82.0) enables unauthenticated remote actors to degrade service availability by sending crafted QUIC Initial packets. Because QUIC Initial packets are processed prior to handshake completion, no session establishment or authentication is required to trigger the condition. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes this straightforwardly reachable on any exposed s2n-quic endpoint.
Remote authenticated actors with S3 write access can achieve code execution in Amazon SageMaker Triton inference containers by replacing model artifacts with malicious pickle payloads that are deserialized without integrity verification. Affected versions are SDK v2 before v2.257.2 and v3 before v3.8.0. The vulnerability requires high-privilege S3 access to the model artifact path but carries severe impact including arbitrary code execution within inference containers. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer overflow in FreeRTOS-Plus-TCP's IPv6 Router Advertisement parser allows an unauthenticated adjacent network actor to corrupt device memory by sending a crafted RA packet containing an oversized prefix length field exceeding the 128-bit maximum valid for IPv6. Affected versions span two branches: 4.0.0-4.2.5 and 4.3.0-4.4.0, with fixes released as V4.2.6 and V4.4.1 respectively. No public exploit code has been identified, EPSS stands at 0.01% (3rd percentile), and SSVC confirms no active exploitation - making this a patch-priority issue rather than an emergency response.
Denial of service via crafted ICMPv6 Router Advertisement in FreeRTOS-Plus-TCP affects embedded devices running versions 4.0.0-4.2.5 and 4.3.0-4.4.0, crashing the device when a truncated PREFIX_INFORMATION option triggers an out-of-bounds read in the IPv6 RA parser. An adjacent-network attacker with no privileges or user interaction can repeatedly crash affected IoT/embedded devices, causing persistent availability loss. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.01% (3rd percentile), but vendor-confirmed patches exist for both affected branches.
Integer underflow in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers enables an adjacent network attacker to crash any affected embedded or IoT device that has outgoing ping support enabled. The flaw spans two active release branches - 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0 - and can trigger a heap out-of-bounds read of up to approximately 65KB, resulting in device denial of service. No public exploit has been identified and EPSS sits at 0.01% (3rd percentile), but the impact on resource-constrained embedded devices can be severe given their limited fault tolerance.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
AWS API MCP Server versions 0.2.14 through 1.3.9 contain an improper path protection flaw in the no-access and workdir features that allows local attackers to bypass file access restrictions and read arbitrary files accessible to the MCP client application. An attacker with local access and user interaction can exploit this vulnerability to expose sensitive local file contents. Users should upgrade to version 1.3.9 or later to remediate this issue.
Timing side-channel attacks in AWS-LC's AES-CCM decryption implementation allow unauthenticated attackers to infer authentication tag validity through precise timing measurements. The vulnerability affects AWS-LC and related cryptographic libraries across multiple AES-CCM variants (128, 192, and 256-bit), potentially enabling attackers to forge authenticated messages. AWS service customers are unaffected, but applications using AWS-LC directly should upgrade to version 1.69.0 or later.
The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. [CVSS 7.8 HIGH]
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP request paths. [CVSS 7.5 HIGH]
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin management. PoC available.
Craft CMS versions 3.5.0-4.16.17 and 5.0.0-RC1-5.8.21 contain a server-side request forgery vulnerability in the save_images_Asset GraphQL mutation that allows authenticated users to bypass hostname validation and retrieve internal URLs by specifying domains resolving to private IP addresses. By uploading files with non-image extensions like .txt, attackers can bypass downstream validation to access sensitive data including AWS instance metadata credentials from the host system. Public exploit code exists for this vulnerability, though patches are available in versions 4.16.18 and 5.8.22.
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. [CVSS 4.3 MEDIUM]
BLUVOYIX's email sending API contains design flaws that permit unauthenticated attackers to send arbitrary emails on behalf of affected organizations through specially crafted HTTP requests. This integrity issue requires no user interaction and could enable large-scale spam or phishing campaigns originating from compromised systems. No patch is currently available for this vulnerability.
AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0 to before 4.0.3.3, Customer applications could be configured to improperly route AWS API calls to non-existent or non-AWS hosts. This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input fie...
Forged plaintext can be substituted for legitimate decryption output in the Amazon S3 Encryption Client for Go (versions up to and including v3.1) when an application stores the encrypted data key (EDK) in an external "Instruction File" instead of the S3 object's metadata record. An attacker who holds write/upload permission to the target bucket can replace that instruction file with a rogue EDK that decrypts the same underlying ciphertext into attacker-chosen content, exploiting the "Invisible Salamanders" property of a non-committing AEAD, so later reads by the victim client return valid-looking but forged data; the impact is integrity-only (no confidentiality or availability loss) and the default metadata-record storage path is not vulnerable. Amazon shipped key commitment in v4.0.0 on 2025-12-16, EPSS is only 0.11% (1st percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect decryption of client-side encrypted S3 objects in AWS SDK for Ruby versions through 1.207.0 allows an authenticated attacker with PutObject permission on the target S3 bucket to replace the encrypted data key (EDK) stored in an S3 instruction file with a rogue EDK that decrypts the same ciphertext to attacker-chosen plaintext. Exploitation requires the application to use the S3 Encryption Client's optional instruction-file mode for EDK storage rather than S3 object metadata; AWS has released a fix in aws-sdk-s3 1.208.0. EPSS is 0.21% (10th percentile) and no public exploit code has been identified at time of analysis, making this a low-urgency, highly conditional cryptographic weakness rather than an immediate threat.
Privilege escalation in Harmonix on AWS framework deployments v0.3.0 through v0.4.1 allows an authenticated IAM principal within the same AWS account to assume an overly-permissive EKS environment provisioning role with administrative privileges, due to the default trust policy granting sts:AssumeRole to the account root principal. Exploitation is limited to in-account actors who already possess sts:AssumeRole permission, and does not affect versions v0.4.2 or later or hardened configurations; no public exploit identified at time of analysis. Vendor-released patch: Harmonix on AWS v0.4.2.
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue arbitrary server-side HTTP requests to internal endpoints, including the AWS Instance Metadata Service at 169.254.169.254. By injecting custom headers that defeat IMDSv2 session-token enforcement, an attacker can pull temporary IAM credentials for the EKS node role when Typebot runs on an EKS node in AWS, escalating a single low-privilege account into full Kubernetes cluster and AWS infrastructure compromise. Publicly available exploit code exists, though EPSS remains low (0.06%, 18th percentile) and the credential-theft outcome only applies to AWS/EKS deployments where IMDS is reachable from the application; version 3.13.1 contains the fix.
Improper verification of AWS EC2 instance identity documents in go-witness (through 0.8.6) and witness (through 0.9.2) allows a forged attestation to be accepted as valid: the AWS attestor reports successful signature verification when the signature is missing or empty, and also when RSA verification of the document fails outright. Addresses: only deployments actually using the AWS attestor are affected, and an attacker must supply or intercept instance identity document data - realistically via Instance Metadata Service (IMDS) impersonation or a man-in-the-middle position against the metadata endpoint, the attack pattern described in AWS Security Bulletin aws-2025-021. Impact is limited to attestation trust/integrity (no code execution, no data disclosure), rated medium severity (CVSS 4.0 base 6.9; assessor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N); no public exploit code has been identified at time of analysis (EPSS ~0.20%, 9th percentile), and the issue is fixed in go-witness 0.9.1 and witness 0.10.1.
Local privilege escalation in AWS VPN Client for macOS versions 1.3.2 through 5.2.0 allows an authenticated, non-administrator local user to gain root code execution by planting a symbolic link in the client's log destination directory and injecting crafted content via client API calls, which is then executed during log rotation under elevated privileges. The flaw is confined to macOS and requires a pre-existing local account, so remote exploitation is not possible; no public exploit code has been identified at time of analysis. AWS has released version 5.2.1 as the complete fix.
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side Request Forgery attacks through the Amazon S3 Connector module, enabling resource location spoofing that could result in unauthorized access to internal systems and data exfiltration. Versions before 2025.1.3, 2024.2.12, and 2023.3.19 are affected. EPSS score of 0.04% (12th percentile) indicates minimal observed exploitation activity, and no public exploit has been identified at time of analysis.
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.