Bulletin 2026-126-AWS details an important security vulnerability affecting QnABot on AWS. A CVE-2026-105811 was found in the optional Amazon Q Business Lambda hook sample. This sample is not automatically deployed with QnABot and requires manual setup, so only those who have deployed it are affected. The vulnerability, present in QnABot versions 7.0.0 through 7.4.5, allows an authenticated remote user to bypass authorization. This bypass could enable unauthorized reading of arbitrary Amazon S3 objects within the deploying AWS account. To mitigate this risk, affected customers must update their QnABot on AWS stack to version 7.4.6 or newer. After updating QnABot, they must also redeploy the Amazon Q Business Lambda hook sample stack. Updating only the QnABot stack will not deliver the necessary fix. This multi-step remediation is crucial for protecting against potential data breaches. All impacted customers should consult the provided article for comprehensive and current information.