AWS
Vulnerability activity for AWS: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 31
- Critical (CVSS 9+)
- 5
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 49
- Critical (CVSS 9+)
- 7
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 52
- Critical (CVSS 9+)
- 7
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.5HighOct 29, 2026aws-privateca-issuer Auth bypass / access controlCVE-2026-119115Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their
- 5.9MediumOct 28, 2026aws-sdk-pandasCVE-2026-118029Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location o
- 7.8HighOct 27, 2026aws-api-mcp-server Auth bypass / access controlCVE-2026-115413Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th
- 7.3HighOct 26, 2026aws-cdk/aws-redshift-alpha SQL injectionCVE-2026-115418SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to vers
- 6.4MediumOct 23, 2026AWS MCP ServerCVE-2026-115845An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer actio
- 5.8MediumOct 23, 2026AWS multi-model-server SSRFCVE-2026-115813Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
- 9.8CriticalOct 23, 2026AWS multi-model-server Path traversal / file handlingCVE-2026-115812Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
- 7.5HighOct 22, 2026aws-c-mqtt Denial of serviceCVE-2026-115417Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
- 8.1HighOct 22, 2026AWS strands-agentsCVE-2026-115419**Summary** Strands Agents SDK is an open-source SDK, available for Python (strands-agents) and TypeScript (@strands-agents/sdk), for building and running AI agents. An issue exists where, under certain circumstances, the Agent2Agent (A2A) server shares conversation history across callers with different context\_id values, allowing one caller to read and influence another caller's session. **Impact** The A2A server did not properly isolate conversation state between callers. In multi-te
- 7.8HighOct 22, 2026aws-sam-cli Code / command injectionCVE-2026-115414OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To remediate this issue, users should upgrade to version 1.166.2 or later.
- 7.7HighOct 22, 2026AWS Amazon Athena Auth bypass / access controlCVE-2026-115416Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not access
- 8.1HighOct 21, 2026AWS Amazon SageMaker Python SDK Code / command injectionCVE-2026-112408Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati
- 8.8HighOct 20, 2026AWS CICD-toolchain-for-serverless-applications Privilege escalationCVE-2026-112407Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
- 9.9CriticalOct 15, 2026AWS Amazon Neptune Engine DeserializationCVE-2026-110812Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto
- 5.3MediumOct 14, 2026AWS SageMaker Python SDK Information disclosureCVE-2026-110248Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
- 6.5MediumOct 9, 2026aws-amplify/graphql-index-transformer Auth bypass / access controlCVE-2026-108096Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package
- 5.9MediumOct 9, 2026aws-tools-for-powershell Information disclosureCVE-2026-107783Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.
- 5.5MediumOct 8, 2026aws-cdk-lib Path traversal / file handlingCVE-2026-107608Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or later.
- 7.8HighOct 8, 2026databases-on-awsCVE-2026-107322An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.
- 5.5MediumOct 8, 2026aws-toolkit-vscode Privilege escalationCVE-2026-107332Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.
- 7.7HighOct 7, 2026AWS Amazon Athena Auth bypass / access controlCVE-2026-107352Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS reme
- 5.7MediumOct 6, 2026Aws bedrock-agentcore-starter-toolkit SSRFCVE-2026-106032Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary o
- 9.0CriticalOct 6, 2026Aws bedrock-agentcore-starter-toolkit Code / command injectionCVE-2026-105812Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorpor
- 6.5MediumOct 6, 2026qnabot-on-aws Auth bypass / access controlCVE-2026-105811Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, m
- 9.0CriticalOct 2, 2026AWS sagemaker-distribution Code / command injectionCVE-2026-104019OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow1.4% likely
- 7.6HighOct 2, 2026AWS loom SSRFCVE-2026-103958Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
- 6.2MediumOct 2, 2026AWS loom SSRFCVE-2026-103957Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.
- 10.0CriticalOct 2, 2026AWS loom Auth bypass / access controlCVE-2026-103956Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 o1.7% likelyNucleiDetection
- 5.3MediumOct 1, 2026AWS powertools-lambda-pythonCVE-2026-104002A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0.
- 8.2HighOct 1, 2026AWS security-agent-mcp-server Code / command injectionCVE-2026-97662An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation. To remediate this issue, users should upgrade to version 0.2.0.
- 6.5MediumOct 1, 2026aws-efs-csi-driver Code / command injectionCVE-2026-103505Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mount
- 7.8HighSep 29, 2026AWS gluonts DeserializationCVE-2026-100308Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use
- 8.8HighSep 24, 2026AWS pgcollection Memory corruptionCVE-2026-96883pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.
- 7.5HighSep 22, 2026AWS s2n-quic Denial of serviceCVE-2026-94450Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.1.9% likely
- 8.1HighSep 17, 2026AWSIoTPythonSDK Auth bypass / access controlCVE-2026-92943Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, use
- 8.7HighSep 16, 2026aws-network-policy-agentCVE-2026-86831Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod ident
- 7.2HighSep 14, 2026AWS iam-identity-center-team Privilege escalationCVE-2026-86830Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended t
- 5.5MediumSep 11, 2026AWS Kiro IDE Information disclosureCVE-2026-89332Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the worksp
- 5.9MediumSep 11, 2026AWS SDK for Go v2CVE-2026-89090An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.
- 5.9MediumSep 11, 2026AWS Advanced JDBC WrapperCVE-2026-18061Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including
- 7.8HighSep 11, 2026AWS projen Code / command injectionCVE-2026-89066Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configurati
- 7.1HighSep 11, 2026AWS projen Path traversal / file handlingCVE-2026-89065Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version
- 9.9CriticalSep 10, 2026AWS Amazon SSM Agent SSRFCVE-2026-89049A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a managed instance and acting with that role's permissions from outside the instance, vi
- 5.9MediumSep 10, 2026AWS Security Agent MCP serverCVE-2026-87913A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket
- 5.9MediumSep 10, 2026AWS Security Agent pluginCVE-2026-87912A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-re
- 9.6CriticalSep 9, 2026AWS Labs postgres MCP Server Code / command injectionCVE-2026-87911An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO 1.7% likely
- 5.5MediumSep 9, 2026AWS Labs MySQL MCP ServerCVE-2026-85788Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whi
- 8.7HighSep 8, 2026AWS Amazon OpenSearch Service XSSCVE-2026-84942Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForF
- 8.1HighAug 4, 2026AWS Amazon Bedrock AgentCore harnessCVE-2026-18830Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.
- 5.7MediumJul 16, 2026AWS bedrock-agentcore Information disclosureCVE-2026-15737AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts a
Top products
- loom3 CVEs in the last year, 1 critical
- projen2 CVEs in the last year
- multi-model-server2 CVEs in the last year, 1 critical
- bedrock-agentcore-starter-toolkit2 CVEs in the last year, 1 critical
- Amazon Athena2 CVEs in the last year
- strands-agents1 CVE in the last year
- security-agent-mcp-server1 CVE in the last year
- sagemaker-distribution1 CVE in the last year, 1 critical
- SageMaker Python SDK1 CVE in the last year
- s2n-quic1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- AWS · Oct 29, 2026CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for KubernetesCVE-2026-119115
- AWS · Oct 28, 2026CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandasCVE-2026-118029
- AWS · Oct 27, 2026CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassCVE-2026-115413
- AWS · Oct 26, 2026CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)CVE-2026-115418
- AWS · Oct 23, 2026CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP ServerCVE-2026-115845
- AWS · Oct 23, 2026CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model ServerCVE-2026-115812CVE-2026-115813
- AWS · Oct 23, 2026CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP ServerCVE-2026-87912CVE-2026-87913
- AWS · Oct 23, 2026CVE-2026-87911CVE-2026-87911
- AWS · Oct 23, 2026CVE-2026-85788 - Issue with awslabs mysql-mcp-serverCVE-2026-85788
- AWS · Oct 23, 2026CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsCVE-2026-84942
- AWS · Oct 22, 2026CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttCVE-2026-115417
- AWS · Oct 22, 2026CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerCVE-2026-115419
- AWS · Oct 22, 2026CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform HookCVE-2026-115414
- AWS · Oct 22, 2026CVE-2026-115416 - Incorrect authorization checks in Amazon Athena engine version 3 query processingCVE-2026-115416
- AWS · Oct 21, 2026CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()CVE-2026-112408
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.