Aws Loom
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Aws Loom.
By the Year
In 2026 there have been 3 vulnerabilities in Aws Loom with an average score of 7.9 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 7.93 |
It may take a day or so for new Loom vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Aws Loom Security Vulnerabilities
AWS Loom <1.7.0 SSRF in tool server & remote agent handling
CVE-2026-103958
7.6 - High
- October 02, 2026
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
SSRF
AWS Loom <1.7.0 SSRF in OAuth2 Discovery Handling
CVE-2026-103957
6.2 - Medium
- October 02, 2026
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.
SSRF
Amazon Loom for AWS <1.6.1 Auth Dependency Auth Bypass Remote SuperAdmin
CVE-2026-103956
10 - Critical
- October 02, 2026
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.
Missing Authentication for Critical Function
