CVE-2026-100308 in Amazon and Aws Products
Published on September 29, 2026
GluonTS arbitrary command execution during model deserialization
Vulnerability Analysis
CVE-2026-100308 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-100308 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
What is a Reflection Injection Vulnerability?
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.
CVE-2026-100308 has been classified to as a Reflection Injection vulnerability or weakness.
Products Associated with CVE-2026-100308
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Aws Gluonts. Just hit a watch button to start following.