TheNote
AWS Latest Bulletins Note
GooglePlay AppStore

AWS Latest Bulletins

The specified webpage from AWS is dedicated to security bulletins. It is one of the reliable sources of information dissemination for the latest security notices and updates. The bulletins primarily cover security advisories, out-of-band patches and other product security updates. These bulletins make it easier for users to stay updated with the latest security considerations, ensuring their infrastructure stays secure and compliant.
Latest Bulletins aws.amazon.com
RSS aws.amazon.com
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass

An issue has been identified in the OpenSearch SQL plugin's Flint extension query handler where insufficient validation allows bypassing the SQL grammar deny list. This vulnerability can be exploited by users with async query access through the direct query endpoint. The affected versions range from v2.13 to v3.6 for the self-managed open-source plugin, and v2.13 to v3.5 for Amazon OpenSearch Service. Updates to versions 3.7 and 2.19.6 for the plugin, and a service software update for Amazon OpenSearch Service, address this vulnerability.
https://aws.amazon.com/security/security-bulletins/rss/2026-081-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 13

CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin

This bulletin addresses CVE-2026-18952, a critical vulnerability in the OpenSearch Security Analytics plugin. The issue stems from missing input validation within the threat intelligence feed parser. An authenticated user with specific privileges can exploit this flaw to perform Server-Side Request Forgery (SSRF). This SSRF allows them to read local files by manipulating a URL parameter. The vulnerability affects self-managed OpenSearch Security Analytics plugins version 2.15.0 and later. For Amazon OpenSearch Service, domains running engine versions 2.15.0 and above are impacted. However, the affected functionality is not enabled by default in the AWS managed service. The vulnerability is fixed in OpenSearch Security Analytics plugin version 3.5.0 and later. Amazon OpenSearch Service has addressed this through service software updates for engine version 3.5. Users are advised to consult the linked article for complete details.
https://aws.amazon.com/security/security-bulletins/rss/2026-079-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 13

CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++

AWS has issued an important bulletin regarding critical vulnerabilities in the AWS SDK for C++. Two specific CVEs, CVE-2026-19642 and CVE-2026-19643, affect the Base64 decoder within the SDK. CVE-2026-19642 describes an out-of-bounds write vulnerability. This could lead to memory corruption or application crashes. CVE-2026-19643 details an out-of-bounds read vulnerability. On certain platforms, this could also result in application crashes. The impact of both these vulnerabilities is limited to the specific process performing the Base64 decoding. All versions of the AWS SDK for C++ up to and including version 1.11.861 are affected. AWS strongly advises users to address these issues promptly. Further details and the most current information can be found in the linked article.
https://aws.amazon.com/security/security-bulletins/rss/2026-080-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 12

CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin

An important security bulletin has been issued regarding an authorization vulnerability in the OpenSearch Alerting plugin. This vulnerability, CVE-2026-19311, affects specific versions of both self-managed and Amazon OpenSearch Service deployments. An authenticated user with certain privileges could exploit this flaw to manipulate index data through crafted monitor requests. Mitigation involves updating to the fixed versions of the plugin or upgrading Amazon OpenSearch Service domains to the patched software release.
https://aws.amazon.com/security/security-bulletins/rss/2026-078-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 12

CVE-2026-19111 - Insecure direct object reference in Strands Agents Tools memory tools

A critical vulnerability, CVE-2026-19111, has been identified in the Strands Agents SDK, specifically impacting the strands-agents-tools package. This vulnerability affects versions prior to 0.8.3. The issue lies within the mongodb_memory, elasticsearch_memory, and mem0_memory tools. These tools incorrectly use a user-controlled namespace parameter for tenant isolation. A malicious actor can craft a prompt to manipulate this namespace. This manipulation allows unauthorized access to other tenants' stored agent memories. Attackers can read, modify, or delete memories belonging to different users. They can also inject false memories into another tenant's namespace. Furthermore, standalone mongodb_memory and elasticsearch_memory functions expose connection parameters. This could permit redirection of the memory layer to an attacker-controlled cluster. Users are strongly advised to update to a version of strands-agents-tools greater than or equal to 0.8.3.
https://aws.amazon.com/security/security-bulletins/rss/2026-077-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 6

CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Bulletin ID: 2026-076-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/05/2026 13:00 PM PDT Description: Amazon DocumentDB MCP Server is an open-source Model Context Protocol (MCP) server that enables AI assistants to interact with Amazon DocumentDB databases. We identified CVE-2026-18954, an incorrect authorization issue where write-capable aggregation pipeline stages ($out, $merge) bypass the read-only mode enforcement logic, potentially allowing an authenticated MCP client to perform write operations on the connected database. Impacted versions: < 1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-076-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 5

CVE-2026-18953 - Improper limitation of a pathname in AWS Transform MCP Server

Bulletin ID: 2026-075-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/05/2026 12:30 PM PDT Description: The AWS Transform MCP Server (awslabs.aws-transform-mcp-server) is an open-source Model Context Protocol (MCP) server that runs locally on a developer's machine and lets AI-powered assistants interact with AWS Transform to run code-transformation jobs and retrieve their artifacts. We identified CVE-2026-18953. Improper limitation of a pathname to a restricted directory in the get_resource tool in awslabs.aws-transform-mcp-server before 0.1.5 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter, which could lead to local code execution. Impacted versions: >=0.1.0 AND <=0.1.4 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-075-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 5

CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows

Bulletin ID: 2026-074-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/04/2026 12:30 PM PDT Description: Kiro is an agentic IDE and command-line interface users install on their desktop. We identified CVE-2026-18656 and CVE-2026-18657, an issue where an uncontrolled search path element on Windows might allow an actor to execute arbitrary code via a maliciously crafted project directory containing a planted executable that is resolved before the system PATH when a local user opens the directory. Impacted versions: - Kiro IDE for Windows between versions 1.0.0 through 1.0.212 - Kiro CLI for Windows prior to v2.10.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-074-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 4

CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation

Bulletin ID: 2026-073-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/04/2026 10:00 AM PDT Description: We have identified CVE-2026-18830 in the Amazon Bedrock AgentCore harness InvokeHarness API. This issue could allow an authenticated user to execute configured tools while bypassing model invocation and associated security controls. When the most recent message in an InvokeHarness request contained a tool-use content block, the agent event loop could dispatch the named tool directly, without model mediation. Please note that potential impact was limited to the tools configured on a given harness. A harness with no configured tools could not execute any tool, and a harness with a restricted tool set was limited to that set. Impacted versions: Amazon Bedrock AgentCore harness InvokeHarness API prior to July 31, 2026. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-073-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 4

CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools

Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package offers pre-built tools, including a shell tool for executing OS commands. This shell tool featured a human consent gate for command approval. However, it also exposed a non_interactive parameter controllable by the LLM. A crafted prompt could set this parameter to true, circumventing the consent gate. This bypass allows arbitrary OS commands to run on the agent's host without operator approval. The vulnerability is identified as CVE-2026-18733. Versions prior to 0.8.0 are impacted by this issue. This bulletin requires operator attention. Further updated information is available in the referenced article.
https://aws.amazon.com/security/security-bulletins/rss/2026-072-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 3

CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands

Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-071-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 3

CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Bulletin ID: 2026-070-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:00 PM PDT Description: AWS Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with Amazon MQ message brokers. We identified CVE-2026-18655, an improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 that may allow a remote unauthenticated actor to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context. Impacted versions: <= 2.0.23 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-070-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Aug 3

CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

This AWS security bulletin, 2026-069-AWS, describes an important vulnerability in the Strands Agents SDK. The strands-agents-tools package, specifically its http_request tool, has an incorrect authorization flaw. This issue, tracked as CVE-2026-18394, could lead to credential disclosure. Operators use HTTP_REQUEST_TOKEN_CONFIG to allowlist hostnames for credential transmission. However, the http_request tool had a proxies parameter in its input schema. A large language model (LLM) could be tricked through a crafted prompt to control this parameter. This allows setting proxies to an actor-controlled endpoint. Despite the hostname allowlist check passing, the credential is still attached to the request. The request is then routed through the actor's proxy on the first hop. Consequently, the credential is disclosed in cleartext within the Authorization header. Affected versions are those earlier than 0.8.2. Users should update to version 0.8.2 or later to mitigate this vulnerability. Further details are available in the linked article, providing comprehensive information.
https://aws.amazon.com/security/security-bulletins/rss/2026-069-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 31

CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Bulletin ID: 2026-065-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 13:00 PM PDT Description: The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. We identified CVE-2026-16796, an improper neutralization of argument delimiters in the install_packages() method that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. Impacted versions: bedrock-agentcore version <1.18.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-065-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 23

CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Bulletin ID: 2026-064-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 11:30 AM PDT Description: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. We identified CVE-2026-16756 where the allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated "Slowloris" denial of service. Impacted versions: aws-smithy-http-server <= 0.66.4 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-064-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 23

CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure

An important security bulletin has been issued for AWS. The issue affects the open-source AWS API MCP Server, named awslabs.aws-api-mcp-server. This server allows AI assistants to execute AWS CLI commands. It features an optional security policy designed to deny or gate specific AWS operations. A vulnerability, CVE-2026-16584, has been identified in its startup process. If the server's security policy initialization fails, it continues to run without checking per-request policies. When fail-closed modes are not enabled in the security policy, unauthorized AWS API operations can be executed. These operations would have otherwise been denied or gated by the policy. Importantly, the underlying IAM permissions for the credentials remain active and are not altered by this vulnerability. The affected versions of the AWS API MCP Server are those greater than or equal to 0.2.13 and less than 1.3.47. Users are advised to consult the provided article for the most current and comprehensive details.
https://aws.amazon.com/security/security-bulletins/rss/2026-063-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 23

CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

AWS has released an important bulletin regarding two vulnerabilities in its s2n-tls library. The first, CVE-2026-16317, is a silent drop of TLS 1.3 encrypted records. This flaw allows a man-in-the-middle attacker to remove individual data records without detection. The issue arises because the outer content type byte is not validated against the required application_data value in TLS 1.3. Consequently, this vulnerability affects all TLS 1.3 connections for both clients and servers. TLS 1.2 and QUIC connections are not impacted by this specific issue. The second vulnerability, CVE-2026-16318, is a memory leak in QUIC transport parameters. This occurs during the HelloRetryRequest phase of QUIC-enabled TLS 1.3 connections. Improper memory allocation management leads to a leak each time a HelloRetryRequest is processed. This can lead to increased memory usage on long-running servers. Only deployments utilizing QUIC are affected by this memory leak. Both vulnerabilities impact s2n-tls versions up to and including v1.7.5. Users are advised to consult the linked article for comprehensive details.
https://aws.amazon.com/security/security-bulletins/rss/2026-062-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 21

CVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

Bulletin ID: 2026-061-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/21/2026 12:45 PM PDT Description: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. We identified CVE-2026-15957, where uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow a third party to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape to a generated SDK or server. Impacted versions: aws-sdk-rust crates < release-2026-06-0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-061-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 21

CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

Bulletin ID: 2026-060-AWS Scope: AWS Content Type: Important (requires attention) / Informational Publication Date: 07/17/2026 12:45 PM PDT Description: AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research. We identified CVE-2026-15415, where improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow_files input. Impacted versions: aws-healthomics-mcp-server <= 0.0.35 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-060-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 17

CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector

Bulletin ID: 2026-059-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/17/2026 12:00 PM PDT Description: Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. These connectors are open source and deployed to the Athena service on a regular basis. We identified CVE-2026-12283. A user with access to an Azure Synapse account can create a table with a specially crafted name that, when queried through the Athena Synapse connector, could result in unintended data being returned. Impacted versions: - versions >= v2022.20.1 (released on 5/19/2022) AND - versions <= v2026.19.1 (released on 5/28/2026) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-059-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 17

CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

Bulletin ID: 2026-057-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/15/2026 12:00 PM PDT Description: jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. We identified CVE-2026-15895, an issue where specially formatted command line arguments can be used to execute shell commands via this tool. Impacted versions: < 1.131.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-057-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 16

CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

Bulletin ID: 2026-058-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/16/2026 10:15 AM PDT Description: Bedrock AgentCore Python SDK (bedrock-agentcore) is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. We identified CVE-2026-15737 in the OpenTelemetry instrumentation of the SDK. Affected versions wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, where a local authenticated user with CloudWatch Logs read access could access the potentially sensitive content. Impacted versions: 1.4.8, 1.5.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-058-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 16

CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

Strands Agents is an open-source Python SDK for building AI agents. A related package, strands-agents-tools, offers pre-built tools, including an elasticsearch_memory tool. This tool is used for agent memory storage. A server-side request forgery vulnerability, CVE-2026-15746, has been identified in the elasticsearch_memory tool. The tool's connection parameters were accessible to the large language model through its schema. When the api_key was omitted by a caller, the tool used the operator's ELASTICSEARCH_API_KEY environment variable. This variable was then sent to the host specified by the language model. A malicious prompt could trick the tool into connecting to a server controlled by a threat actor. This connection would then reveal the operator's Elasticsearch API key. The vulnerability affects versions prior to 0.7.0 of the software.
https://aws.amazon.com/security/security-bulletins/rss/2026-056-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 15

CVE-2026-15738 - Issue with AWS Load Balancer Controller Cross-Namespace Traffic Interception via HTTPRoute/GRPCRoute Priority Ordering

Bulletin ID: 2026-055-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:30 PM PDT Description: The AWS Load Balancer Controller is an open-source Kubernetes controller that manages AWS Elastic Load Balancing resources for Kubernetes clusters. We identified CVE-2026-15738, an incorrect rule precedence ordering issue in the Gateway API listener rule generation logic. When both an HTTPRoute and a GRPCRoute are attached to the same Application Load Balancer (ALB) HTTPS listener with the same hostname, the controller assigns ALB listener rule priorities based on route kind rather than route specificity. This causes all HTTPRoute-derived rules to receive lower ALB priority numbers, evaluated first by the ALB, than GRPCRoute-derived rules, regardless of which route is more specific. A namespace-scoped user with permission to create HTTPRoute objects in a namespace admitted by a shared Gateway can create a catch-all HTTPRoute that intercepts traffic intended for a more-specific GRPCRoute in another namespace. Impacted versions: AWS Load Balancer Controller v3.4.1 and any version that includes support for attaching both HTTPRoute and GRPCRoute to the same listener (introduced in PR #4794) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-055-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 14

CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL

Bulletin ID: 2026-054-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:00 PM PDT Description: AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. We identified CVE-2026-15643, a server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Impacted versions: < 0.0.14 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-054-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 14

CVE-2026-14904 - Improper Link Resolution in Auth.GetUserPrivateKey in AWS Research and Engineering Studio

Bulletin ID: 2026-053-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/07/2026 09:45 AM PDT Description: AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. We identified an improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. Impacted versions: <=2026.03 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-053-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 7

CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-052-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 6

CVE-2026-14265- Deserialization of Untrusted Data in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Bulletin ID: 2026-051-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:45 PM PDT Description: The AWS Advanced JDBC Wrapper is an open-source JDBC driver wrapper that extends a JDBC driver to enable Amazon Aurora and AWS Cloud features such as failover handling and caching. We identified CVE-2026-14265, an issue in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper. When this plugin is enabled, query results read from the shared Redis/Valkey cache are deserialized without class filtering. An actor with write access to the shared cache infrastructure could insert a crafted serialized Java object that, when read by an application, results in execution of arbitrary code on the application server. Impacted versions: >=3.3.0 AND <=4.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-051-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 1

CVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib

Bulletin ID: 2026-050-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 12:15 PM PDT Description: AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified CVE-2026-13760, an OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that could allow an actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. Impacted versions: < 2.260.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-050-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 1

CVE-2026-13769 – Insecure file permissions in AWS CLI

Bulletin ID: 2026-049-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/01/2026 11:45 AM PDT Description: The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. We identified CVE-2026-13769 in AWS CLI on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) wrote credential and configuration files with world-readable permissions, which allows other local users on the same host to read credentials. Impacted versions: <=1.44.77 (v1) AND <=2.34.28 (v2) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-049-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jul 1

CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF

Bulletin ID: 2026-048-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/29/2026 11:15 PM PDT Description: AWS WAF is a web application firewall that monitors the HTTP(S) requests that are forwarded to your protected web application resources. We identified CVE-2026-13762 and CVE-2026-13763, which are issues affecting HTTP/2 multi-frame request body inspection by AWS WAF. CVE-2026-13762 affects AWS WAF deployment with CloudFront. This issue was remediated server-side; no customer action is required. CVE-2026-13763 affects AWS WAF deployment with AWS Application Load Balancer (ALB). Under certain conditions, a crafted multi-frame HTTP/2 request could cause only a partial request body to be inspected. This issue has been addressed on ALB, and customers can ensure full protection by configuring how AWS WAF inspects HTTP/2 request bodies on their ALB. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-048-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 29

CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins

AWS has released an important security bulletin concerning Language Servers for AWS and Amazon Q Developer IDE plugins. Two vulnerabilities have been identified, requiring immediate attention. The first, CVE-2026-12957, is an improper trust boundary enforcement issue present in versions before 1.65.0. This could lead to automatic command execution if a local user opens a crafted workspace and trusts it. The second vulnerability, CVE-2026-12958, involves missing symlink validation. It affects versions prior to 1.69.0 and can be exploited through a maliciously crafted symlink pointing outside the workspace. Both vulnerabilities are present in the Amazon Q Developer IDE plugins, which utilize these language servers. These critical issues are resolved in Language Servers for AWS version 1.69.0. Affected products include various versions of the Amazon Q Developer IDE plugins for VS Code, JetBrains, Eclipse, and Visual Studio. Users are strongly advised to update to the latest versions to mitigate these risks. Further details and the most current information are available in the linked AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-047-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 23

Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

AWS has issued a critical bulletin regarding vulnerabilities in containerd, a container runtime used by Kubernetes. Five specific issues have been identified in the containerd CRI plugin. These vulnerabilities affect versions 1.7 through 2.3 of containerd. The identified CVEs include local image tag poisoning, command execution via image configuration, CDI annotation smuggling, arbitrary host file reading, and a denial-of-service attack triggered by images. These issues impact a range of AWS managed container services. This includes Amazon EKS, Amazon ECS, AWS Fargate, Bottlerocket, and Amazon Linux. The bulletin urges users to pay close attention to these security findings. Users should consult the linked article for the most current and comprehensive details. Immediate action may be required to mitigate potential risks.
https://aws.amazon.com/security/security-bulletins/rss/2026-046-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 19

CVE-2026-12530 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

AWS has released a security bulletin regarding the Bedrock AgentCore Python SDK. A vulnerability, identified as CVE-2026-12530, has been discovered in the install_packages() method of the Code Interpreter client. This method failed to sufficiently sanitize package name arguments used in shell commands. Specifically, an incomplete blocklist allowed crafted inputs to bypass validation. This bypass could exploit pip's --index-url flag to redirect package installation to a malicious third-party server. Additionally, the -r flag could be used to read and expose arbitrary files within the Code Interpreter sandbox. The vulnerable versions of the SDK range from 1.1.3 up to, but not including, 1.6.1. Developers using these versions are strongly advised to take immediate action. Further details and the most current information can be found in the provided article.
https://aws.amazon.com/security/security-bulletins/rss/2026-044-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 17

CVE-2026-11931 - Insecure Permissions on Authentication Token Cache File in Kiro IDE

Bulletin ID: 2026-045-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/15/2026 11:45 AM PDT Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified CVE-2026-11931, where incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600). Impacted versions: < 0.11.133 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-045-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 15

CVE-2026-12043 - Heap double-free in AWS Common Runtime aws-c-http

Bulletin ID: 2026-043-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/12/2026 11:45 AM PDT Description: AWS Common Runtime aws-c-http is a HTTP client library used by AWS SDKs for handling http requests to AWS services. We identified CVE-2026-12043, an issue where improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames. Impacted versions: aws-c-http >= 0.4.22 AND <= 0.10.15 Exposed in following sdk versions: - aws-sdk-cpp >= 1.11.41, <= 1.11.814 - aws-sdk-java-v2 >= 2.44.27, <= 2.44.14 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-043-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 12

CVE-2026-10740 - Excessive memory allocation in s2n-quic

Bulletin ID: 2026-042-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/10/2026 11:15 AM PDT Description: s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-10740, an issue of unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.82.0. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required. Impacted versions: < v1.82.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-042-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 10

CVE-2026-10740 - Excessive memory allocation in s2n-quic

Bulletin ID: 2026-041-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/10/2026 10:45 AM PDT Description: AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified CVE-2026-11417, an OS command injection issue in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) that may allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the actor to control the value of one or more of the affected bundling properties in the CDK application. Impacted versions: < 2.245.0 (on Windows, < 2.246.0) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-041-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 10

CVE-2026-11393 - Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent Import

Bulletin ID: 2026-040-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/08/2026 11:45 AM PDT Description: The AWS AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. We identified CVE-2026-11393 in which improper neutralization of triple-quote characters during Python code generation may allow an authenticated user in the same AWS account to inject arbitrary Python code into the source file generated by the "agentcore add agent ‐‐type import" command. Specifically, the collaborationInstruction field of a Bedrock Agent collaborator association was interpolated into a triple-quoted Python docstring using single-quote escaping rather than triple-quote escaping. A user with bedrock:AssociateAgentCollaborator IAM permission could craft a collaborationInstruction value containing """ to break out of the docstring boundary in the generated main.py of the imported agent. If that generated file was subsequently executed - either via agentcore dev on the developer's local machine, or via agentcore deploy followed by agentcore invoke in the AgentCore Runtime environment - the injected Python would run with the credentials available in that context. Impacted versions: - @aws/agentcore >= 0.4.0 AND <= 0.14.1 - preview versions >= 0.3.0-preview.7.0 and <= 1.0.0-preview.8 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-040-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 8

CVE-2026-11400 and CVE-2026-11401

Bulletin ID: 2026-039-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/025/2026 12:15 PM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2026-11400(JDBC) and CVE-2026-11401(Go), an issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS Advanced JDBC Wrapper >=3.0.0 and < 4.0.1 - AWS Advanced Go Wrapper release 2026-04-06 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-039-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 5

CVE-2026-10584 - HTTPS Fallback to HTTP in Graph Explorer

Bulletin ID: 2026-038-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/02/2026 12:15 PM PDT Description: Graph Explorer is an open source application that provides visualization and exploration of data in graph databases such as Amazon Neptune. We identified CVE-2026-10584 where, under certain circumstances, the server silently falls back to HTTP when HTTPS is enabled but certificates are unavailable, resulting in cleartext transmission of sensitive information. Impacted versions: >= 1.1.0 AND < 3.0.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-038-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 2

CVE-2026-10591 - Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths

Bulletin ID: 2026-037-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/02/2026 08:45 AM PDT Description: Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-10591. Insufficient access control restrictions in the file write tool in Kiro IDE prior to version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. Impacted versions: <0.11 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-037-aws/ aws.amazon.com
RSS Hunter RSS Hunter • Jun 2

CVE-2026-9291 - Insecure Deserialization in Amazon Braket SDK Job Results Processing

A critical security vulnerability has been found in the Amazon Braket SDK, affecting versions 1.10.0 through 1.116.9. This vulnerability, identified as CVE-2026-9291, concerns an insecure deserialization issue within the job results processing. The deserialize_values() function incorrectly trusts the dataFormat field from JSON files. This field controls whether pickle.loads() is used to process data. A malicious actor with S3 write access can exploit this flaw. They can manipulate the dataFormat field to trigger arbitrary code execution. Specifically, they can change the format to pickled_v4 and inject malicious code. This allows remote authenticated users to execute code on machines processing job results. This could lead to a compromise of systems analyzing quantum job outputs. Users are strongly advised to consult the provided article for comprehensive details. Immediate action is required to address this significant security risk.
https://aws.amazon.com/security/security-bulletins/rss/2026-036-aws/ aws.amazon.com
RSS Hunter RSS Hunter • May 22

CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI

Bulletin ID: 2026-035-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/22/2026 09:45 AM PDT Description: Kiro CLI is a command-line AI coding assistant that enables developers to interact with AI models to execute code, manage files, and run shell commands. We identified CVE-2026-9255, an issue where missing input source validation in the tool authorization prompt could allow a local actor to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. Impacted versions: kiro-cli prior to 1.28.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-035-aws/ aws.amazon.com
RSS Hunter RSS Hunter • May 22

CVE-2026-9133 - Arbitrary file read in rabbitmq-aws plugin

Bulletin ID: 2026-034-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/20/2026 12:45 PM PDT Description: rabbitmq-aws is a RabbitMQ plugin that resolves AWS ARNs in broker configuration at startup, fetching secrets (e.g., TLS certificates, private keys, passwords) from AWS services (Secrets Manager, S3, ACM Private CA) and passing them in-memory to RabbitMQ. We identified CVE-2026-9133, an active debug code issue in the plugin's ARN resolver. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. The debug code was inadvertently shipped in production builds with no mechanism to disable it. Impacted versions: >=0.1.0, <=0.2.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-034-aws/ aws.amazon.com
RSS Hunter RSS Hunter • May 20

CVE-2026-8838 - Remote Code Execution in amazon-redshift-python-driver

Bulletin ID: 2026-033-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/18/2026 13:45 PM PDT Description: amazon-redshift-python-driver is the official Python connector for Amazon Redshift. We identified a code injection issue in versions 2.1.13 and earlier that could allow a rogue server or man-in-the-middle to execute arbitrary code on the client. Impacted versions: <=2.1.13 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-033-aws/ aws.amazon.com
RSS Hunter RSS Hunter • May 18

CVE-2026-8686 - Heap out-of-bounds read in coreMQTT MQTT5 property parsing

Bulletin ID: 2026-032-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/15/2026 11:45 AM PDT Description: coreMQTT is a lightweight MQTT client library for embedded devices. We identified CVE-2026-8686, an issue where missing bounds validation in the MQTT v5.0 SUBACK and UNSUBACK property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service (crash via heap out-of-bounds read) by sending a crafted packet. Impacted versions: v5.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
https://aws.amazon.com/security/security-bulletins/rss/2026-032-aws/ aws.amazon.com
RSS Hunter RSS Hunter • May 15