Amazon Aws

Amazon EKS Network Policy Agent <=1.3.7 eBPF conntrack map poisoning
CVE-2026-122266 8.7 - High - November 04, 2026

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames. To remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7).

SoC

Firecracker 0.23.0-1.16.1 Memory Remap Mishandling (priv esc)
CVE-2026-122192 7.5 - High - November 04, 2026

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Detection of Error Condition Without Action

Amazon Redshift JDBC Driver 2.3.0: Unsafe Reflection in URL/Profile Allow RCE
CVE-2026-119084 8.1 - High - November 03, 2026

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

Reflection Injection

Cross-site scripting in AWS Amplify MapLibreGLJSAmplify <4.0.3 via GeoJSON popupRender
CVE-2026-121652 5.4 - Medium - November 03, 2026

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

XSS

Babelfish for PostgreSQL Improper Access Control (CVE-2026-119922) v1.2-5.4
CVE-2026-119922 8.8 - High - November 03, 2026

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.

Incorrect Privilege Assignment

CVE-2026-116635: Path traversal in aws-serverless-mcp-server pre-0.2.1 Deployment Status component
CVE-2026-116635 6.1 - Medium - November 02, 2026

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1.

Relative Path Traversal

XSS in aidlc-traceability CLI HTML report generator (AWS AI-DLC Workflows)
CVE-2026-120497 5 - Medium - November 02, 2026

Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

XSS

AWS VEW Template Engine XSS/Code Exec via CloudFormation Body
CVE-2026-119085 8.8 - High - November 02, 2026

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

1336

AWS SDK for pandas (awswrangler) SQL Identifier Injection 3.5.2-3.17.0
CVE-2026-119301 7.9 - High - November 02, 2026

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

Improper Neutralization of Quoting Syntax

AWS API MCP Server <1.6.0 OAuth Token Audience Validation Bypass
CVE-2026-115413 7.8 - High - October 27, 2026

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.

Origin Validation Error

SQLi in aws-cdk/aws-redshift-alpha DB-Query Handlers (before 2.274.0-alpha)
CVE-2026-115418 7.3 - High - October 26, 2026

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.

SQL Injection

An incomplete list of dis
CVE-2026-115845 6.4 - Medium - October 23, 2026

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.

Denylist / Deny List

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might
CVE-2026-115813 5.8 - Medium - October 23, 2026

Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.

SSRF

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might
CVE-2026-115812 9.8 - Critical - October 23, 2026

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.

Relative Path Traversal

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have
CVE-2026-115416 7.7 - High - October 22, 2026

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required.

AuthZ

Brotli Decoder Buffer Overflow (1.0.3-1.2.0)
CVE-2026-111497 9.2 - Critical - October 22, 2026

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Memory Corruption

PHP RCE via stale global state
CVE-2026-109619 9.2 - Critical - October 21, 2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Dangling pointer

PHP RCE via OOM corruption October 2026
CVE-2026-109618 9.2 - Critical - October 21, 2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Dangling pointer

Linux Kernel IPv4 Checksum Validation Vulnerability (CVE-2026-99999)
CVE-2026-99999 9.3 - Critical - October 15, 2026

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Improper Input Validation

Linux kernel TCP UAF in inet_opt handling
CVE-2026-98432 9.8 - Critical - October 15, 2026

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Arg Injection in AWS security-agent-mcp-server <0.2.0 Diff Scan
CVE-2026-97662 8.2 - High - October 01, 2026

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation. To remediate this issue, users should upgrade to version 0.2.0.

Argument Injection

AWS pgcollection 2.0-2.1.1 TypeConfusion Exec Code as postgres OS User
CVE-2026-96883 8.8 - High - September 24, 2026

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.

Object Type Confusion

Amazon Kiro IDE <1.0.242 Remote Code Injection via Agent Context
CVE-2026-95985 8.8 - High - September 24, 2026

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.

Inclusion of Functionality from Untrusted Control Sphere

s2nQUIC (<1.89) DOS via crafted UDP DCI length
CVE-2026-94450 7.5 - High - September 22, 2026

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.

Improper Validation of Specified Quantity in Input

Amazon Connect Salesforce Lambda <5.26: Missing Auth in sfExecuteAWSService
CVE-2026-94384 8.1 - High - September 22, 2026

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.

AuthZ

AWS IoT Device SDK Python TLS Hostname Mismatch CVE-2026-92943 (1.5.3-1.6.0)
CVE-2026-92943 8.1 - High - September 17, 2026

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

Improper Validation of Certificate with Host Mismatch

AWS EKS Network Policy Agent <1.4: Pod ID Collision Policy Bypass
CVE-2026-86831 8.7 - High - September 16, 2026

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions. To remediate this issue, users should upgrade to Amazon EKS Network Policy Agent 1.4.0 or later and Amazon VPC CNI Managed Add-on v1.22.4 or later (which includes Network Policy Agent v1.4.0).

Improper Validation of Unsafe Equivalence in Input

AWS IAM IC TEAM <1.5.1 temp access privilege escalation
CVE-2026-86830 7.2 - High - September 14, 2026

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Incorrect Privilege Assignment

Amazon Kiro IDE 0.8.135+ Remote Info Disclosure via Kiro Powers
CVE-2026-89332 5.5 - Medium - September 11, 2026

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.

Inclusion of Functionality from Untrusted Control Sphere

Unrecovered Panic in AWS SDK-Go v2 Header Decoder
CVE-2026-89090 5.9 - Medium - September 11, 2026

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

Uncaught Exception

XXE in AWS Advanced JDBC Wrapper 3.3.04.2.0 RemoteQueryCachePlugin
CVE-2026-18061 5.9 - Medium - September 11, 2026

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.

XXE

projen <0.103.0 Task Injection via Shell Metacharacters
CVE-2026-89066 7.8 - High - September 11, 2026

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

Shell injection

Relative path traversal in projen <0.101.37: recursive file deletion
CVE-2026-89065 7.1 - High - September 11, 2026

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.

Relative Path Traversal

Amazon SSM Agent SSRF via Port Forwarding (3.3.4850)
CVE-2026-89049 9.9 - Critical - September 10, 2026

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a managed instance and acting with that role's permissions from outside the instance, via a crafted destination host value that uses an alternate representation of a denied link-local address. To remediate this issue, users should upgrade to version 3.3.4851.0 or later.

SSRF

Amazon DJL 0.13-0.36 Integer Overflow in Tensor Buffer Validation
CVE-2026-85228 9.1 - Critical - September 10, 2026

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To remediate this issue, users should upgrade to version 0.37.0 or above.

Integer Overflow or Wraparound

AWS Security Agent MCP before 0.2.0 S3 Ownership Verification Flaw
CVE-2026-87913 5.9 - Medium - September 10, 2026

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Unverified Ownership

Missing S3 Bucket Ownership Verification in AWS Security Agent Plugin before 1.1.0
CVE-2026-87912 5.9 - Medium - September 10, 2026

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 1.1.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Unverified Ownership

OS Command Injection in Amazon awslabs Postgres-MCP-Server 1.1.6 Read-Only Mode
CVE-2026-87911 9.6 - Critical - September 09, 2026

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode. To remediate this issue, users should upgrade to version 1.1.7 or later.

Shell injection

Amazon awslabs mysql-mcp-server 1.0.23: SQL Detector Bypass via Inline Comments
CVE-2026-85788 5.5 - Medium - September 09, 2026

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.

Denylist / Deny List

OpenSearch Dashboards: Remote JS Execution via Vega Input Validation Flaw
CVE-2026-84942 8.7 - High - September 08, 2026

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

XSS

Amazon Postgres-MCP-Server SQL Injection 1.1.6
CVE-2026-85787 7.1 - High - September 04, 2026

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or above.

Denylist / Deny List

Amazon ion-java < 1.12.1: GZIP Decompression DoS via Unchecked Compression
CVE-2026-85786 8.7 - High - September 04, 2026

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

Data Amplification

Recursive dir deletion via crafted PV volumeHandle in EFS CSI Driver <v3.4.1
CVE-2026-85781 5.1 - Medium - September 04, 2026

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upgrade to version v3.4.1.

Unverified Ownership

Amazon Linux log4j-cve-2021-44228-hotpatch OS Command Injection before 1.3-9
CVE-2026-85656 8.5 - High - September 04, 2026

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Shell injection

Amazon DynamoDB MCP Server <2.1.6: TL Template Exploit
CVE-2026-85654 7.1 - High - September 04, 2026

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

1336

AWS FPGA Dev Kit 2.3.4 Temp File Priv Esc via Installation
CVE-2026-85028 7.8 - High - September 03, 2026

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges. To remediate this issue, users should upgrade to version 2.3.4.

Creation of Temporary File in Directory with Insecure Permissions

AWS CodeCatalyst Blueprint Resynthesis OS Command Injection (CWE-78) <0.3.156
CVE-2026-85012 8 - High - September 03, 2026

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint resynthesis environment via shell metacharacters in the owner field of a [local] merge strategy entry in a crafted .ownership-file. Version 0.3.156 removes shell interpretation of the owner field, running the command directly rather than through a shell, and rejects values outside an allowlisted command form. This eliminates shell metacharacter command injection. To remediate this issue, users should upgrade to version 0.3.156 or later. No action is required for use of the Amazon CodeCatalyst service. Resynthesis runs in an isolated per-project environment with scoped credentials, and the service applies server-side validation there that rejects [local] merge strategy commands outside a restricted allowlisted form, including for blueprint versions published before 0.3.156.

Shell injection

Amazon Ion-C <1.1.6 Uncontrolled Recursion DoS via Crafted Ion Data
CVE-2026-84851 7.5 - High - September 02, 2026

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

Stack Exhaustion

Amazon SageMaker SDK v3.11.0/v2.256.0: HMAC Leak @step/@remote
CVE-2026-83551 7.2 - High - September 01, 2026

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Cleartext Storage of Sensitive Information

OpenSearch SQL Cursor Pagination Unrestricted Deserialization RCE
CVE-2026-83497 8.8 - High - August 31, 2026

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

Marshaling, Unmarshaling