Amazon Amazon
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Amazon product.
RSS Feeds for Amazon security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Amazon products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Amazon Sorted by Most Security Vulnerabilities since 2018
Recent Amazon Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-11-12 | CVE-2026-126793 - Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper | November 12, 2026 |
| 2026-11-12 | CVE-2026-127119 - Unverified ownership of the default EMR cluster log location in AWS SDK for pandas | November 12, 2026 |
| 2026-11-11 | CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry | November 11, 2026 |
| 2026-11-11 | CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator | November 11, 2026 |
| 2026-11-10 | CVE-2026-124848 - Incorrect default permissions on session transcripts and prompt history in Kiro CLI | November 10, 2026 |
| 2026-11-10 | CVE-2026-126087 - Untrusted search path in OpenJD Sessions for Python and the AWS Deadline Cloud worker agent | November 10, 2026 |
| 2026-11-10 | CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization | November 10, 2026 |
| 2026-11-09 | CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK | November 9, 2026 |
| 2026-11-09 | CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI | November 9, 2026 |
| 2026-11-06 | CVE-2026-119923 and CVE-2026-119924: Issues with Babelfish for Aurora PostgreSQL | November 6, 2026 |
By the Year
In 2026 there have been 207 vulnerabilities in Amazon with an average score of 7.5 out of ten. Last year, in 2025 Amazon had 46 security vulnerabilities published. That is, 161 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.82.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 207 | 7.52 |
| 2025 | 46 | 6.69 |
| 2024 | 26 | 6.96 |
| 2023 | 23 | 6.74 |
| 2022 | 23 | 7.27 |
| 2021 | 17 | 8.64 |
| 2020 | 8 | 6.94 |
| 2019 | 6 | 6.83 |
| 2018 | 19 | 6.76 |
It may take a day or so for new Amazon vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Amazon Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-126793 | Nov 12, 2026 |
AWS Advanced Go Wrapper awssql < v2.0.3 Untrusted Search Path PrivEscAn untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later. |
Aws
|
| CVE-2026-127119 | Nov 12, 2026 |
awswrangler <3.18 EMR default log S3 read info disclosureUnverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use. |
Aws
|
| CVE-2026-125926 | Nov 11, 2026 |
Amazon mcp-gateway-registry <1.35.0 SSRF in registration APIServer-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0. |
Aws
|
| CVE-2026-100307 | Nov 11, 2026 |
Amazon mcp-gateway-registry <1.25 Auth bypass in external mgmt APIMissing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request. To remediate this issue, users should upgrade to version 1.25.0. |
Aws
|
| CVE-2026-124848 | Nov 10, 2026 |
Kiro CLI (<2.27.0) Local File Permission DisclosureIncorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. To remediate this issue, users should upgrade to Kiro CLI version 2.27.0 or later and launch it once. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner. |
Aws
Kiro Cli
|
| CVE-2026-126087 | Nov 10, 2026 |
AWS Deadline Cloud worker agent OpenJD Sessions <0.11.0 Untrusted Search PathUntrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable. To remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side. |
Aws
|
| CVE-2026-125271 | Nov 10, 2026 |
aws-api-mcp-server <1.5.1: Op name normalization bypasses security policyIncorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters. To remediate this issue, users should upgrade to version 1.5.1. |
Aws
|
| CVE-2026-124035 | Nov 09, 2026 |
Amazon Braket Schemas <1.32.2 Unsafe Reflection RCE via Schema ValidationUnsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document. We recommend you upgrade to amazon-braket-schemas version 1.32.2 or later. |
Amazon Braket Schemas
Aws
|
| CVE-2026-124034 | Nov 09, 2026 |
Amazon Braket SDK <1.127.7 Path Traversal in Hybrid Job Input DownloadRelative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys. We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later. |
Aws
|
| CVE-2026-124033 | Nov 09, 2026 |
AWS ParallelCluster CLI <3.16.0 Path Traversal in export-logsThe export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command. To remediate this issue, users should upgrade to version 3.16.0 or later. |
Aws
|
| CVE-2026-119924 | Nov 06, 2026 |
Babelfish for PostgreSQL <=5.4 OOB Read in TDS RPC ParserAn out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433). To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. |
Amazon Aurora Postgresql With Babelfish
Aws
|
| CVE-2026-119923 | Nov 06, 2026 |
Babelfish for PostgreSQL TDS prelogin heap overflow (<=5.4)A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. |
Amazon Aurora Postgresql With Babelfish
Aws
|
| CVE-2026-122193 | Nov 06, 2026 |
AWS SSM REX OS Command Injection (CVE-2026-122193)OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run. |
Aws
|
| CVE-2026-119083 | Nov 05, 2026 |
GluonTS <0.17.0 Path Traversal in Tar ExtractionPath traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later. |
Aws
|
| CVE-2026-122266 | Nov 04, 2026 |
Amazon EKS Network Policy Agent <=1.3.7 eBPF conntrack map poisoningImproper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7). |
Aws
|
| CVE-2026-122192 | Nov 04, 2026 |
Firecracker 0.23.0-1.16.1 Memory Remap Mishandling (priv esc)Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later. |
Aws
|
| CVE-2026-109518 | Nov 04, 2026 |
APT client hardlink reuse allows root RCE via onpath proxyOn Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration |
Aws
|
| CVE-2026-119084 | Nov 03, 2026 |
Amazon Redshift JDBC Driver 2.3.0: Unsafe Reflection in URL/Profile Allow RCEUnsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later. |
Aws
|
| CVE-2026-121652 | Nov 03, 2026 |
Cross-site scripting in AWS Amplify MapLibreGLJSAmplify <4.0.3 via GeoJSON popupRenderCross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later. |
Aws
|
| CVE-2026-119922 | Nov 03, 2026 |
Babelfish for PostgreSQL Improper Access Control (CVE-2026-119922) v1.2-5.4Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch. |
Aws
Amazon Aurora Postgresql With Babelfish
|
| CVE-2026-116635 | Nov 02, 2026 |
CVE-2026-116635: Path traversal in aws-serverless-mcp-server pre-0.2.1 Deployment Status componentImproper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1. |
Aws
|
| CVE-2026-120497 | Nov 02, 2026 |
XSS in aidlc-traceability CLI HTML report generator (AWS AI-DLC Workflows)Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16. |
Aws
|
| CVE-2026-119085 | Nov 02, 2026 |
AWS VEW Template Engine XSS/Code Exec via CloudFormation BodyImproper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench. |
Aws
|
| CVE-2026-119301 | Nov 02, 2026 |
AWS SDK for pandas (awswrangler) SQL Identifier Injection 3.5.2-3.17.0Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later. |
Aws
|
| CVE-2026-119117 | Oct 30, 2026 |
Amazon Kinesis Producer Library <1.0.8 Log Credential Leak (Java)Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later. |
Aws
|
| CVE-2026-119086 | Oct 30, 2026 |
FreeRTOS-Kernel <11.3.3 Queue-Set Stack Overflow PrivEscMissing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary. To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected. |
Aws
|
| CVE-2026-119148 | Oct 30, 2026 |
AWS Nitro Enclaves SDK C <0.4.6 Incomplete String Validation, KMS ImpersonationIncomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6. |
Aws
|
| CVE-2026-119116 | Oct 30, 2026 |
CVE-2026-119116A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6. |
Aws
|
| CVE-2026-119115 | Oct 29, 2026 |
AWS Private CA Connector for Kubernetes issuer auth bypass < v1.10.1Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references. |
Aws
|
| CVE-2026-115415 | Oct 28, 2026 |
Strands Agents Tools <0.8.6: Improper Input Neutralization (env disclosure)Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool. |
Aws
Strands Agents Tools
|
| CVE-2026-118029 | Oct 28, 2026 |
AWS SDK for Pandas <3.16.1 Athena default S3 bucket ownership issueUnverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration. |
Aws
|
| CVE-2026-115413 | Oct 27, 2026 |
AWS API MCP Server <1.6.0 OAuth Token Audience Validation BypassMissing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server. |
Aws
|
| CVE-2026-115418 | Oct 26, 2026 |
SQLi in aws-cdk/aws-redshift-alpha DB-Query Handlers (before 2.274.0-alpha)SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC. |
Aws
|
| CVE-2026-115845 | Oct 23, 2026 |
AWS MCP Server Python run_script validator code injectionAn incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required. |
Aws
|
| CVE-2026-115813 | Oct 23, 2026 |
AWS Multi Model Server 1.1.11 SSRF in model download pathServer-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution. |
Aws
|
| CVE-2026-115812 | Oct 23, 2026 |
AWS Multi Model Server 1.1.11 - Relative Path Traversal in Model ExtractionRelative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution. |
Aws
|
| CVE-2026-115416 | Oct 22, 2026 |
Athena Engine v3 Auth Bypass Allows CrossAccount Data ExposureIncorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required. |
Aws
|
| CVE-2026-111497 | Oct 22, 2026 |
node2shell Brotli Decoder Buffer Overflow (1.0.3-1.2.0)A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
Aws
|
| CVE-2026-112408 | Oct 21, 2026 |
SageMaker Python SDK <3.10.0 / <2.257.3 Code Exec via Unchecked S3 BucketMissing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2). |
Aws
|
| CVE-2026-109619 | Oct 21, 2026 |
PHP2shell: PHP RCE via stale global statePHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
Aws
|
| CVE-2026-109618 | Oct 21, 2026 |
PHP2shell: PHP RCE via OOM corruption Oct 2026PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
Aws
|
| CVE-2026-111943 | Oct 21, 2026 |
Go crypto/x509 intermediate cert trust bypass (CVE-2026-111943)On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy. |
Aws
|
| CVE-2026-112407 | Oct 20, 2026 |
CVE-2026-112407Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later. |
Aws
|
| CVE-2026-112380 | Oct 20, 2026 |
Kiro Crew <0.7.2 WhatsApp Group Auth Bypass RCEMissing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2. |
Aws
Kiro Crew
|
| CVE-2026-109588 | Oct 16, 2026 |
FreeRTOS-Kernel <11.3.2 Numeric Truncation in MPU Buffer Check Allows PrivEscNumeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later. |
Aws
|
| CVE-2026-109587 | Oct 16, 2026 |
FreeRTOS-Kernel MPU auth bypass (preV11.3.2)Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later. |
Aws
|
| CVE-2026-99999 | Oct 15, 2026 |
Linux Kernel IPv4 Checksum Validation Vulnerability (CVE-2026-99999)In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. |
Aws
|
| CVE-2026-98432 | Oct 15, 2026 |
Linux kernel TCP UAF in inet_opt handlingIn the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch. |
Aws
|
| CVE-2026-106032 | Oct 06, 2026 |
Amazon Bedrock AgentCore Starter Toolkit <0.3.14 SSRF in OpenAPI schemaServer-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files, via crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group. To remediate this issue, users should upgrade to version 0.3.14. Note that bedrock-agentcore-starter-toolkit is deprecated. The @aws/agentcore npm CLI is the supported replacement and does not contain this issue. Migration to @aws/agentcore is the recommended long-term path. |
Aws
|
| CVE-2026-105812 | Oct 06, 2026 |
Amazon Bedrock AgentCore Starter Toolkit <0.3.14 Code Injection via ImportImproper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding. To remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced. |
Aws
|