AWS Security Bulletins

CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling

CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF

CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution

CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS

CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver

CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python

CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization

CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

CVE-2026-94384 - Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService

CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection

CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library

CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

CVE-2026-87911

CVE-2026-85788 - Issue with awslabs mysql-mcp-server

CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

CVE-2026-85654 - Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

CVE-2026-85786 - Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

CVE-2026-85781 - Unverified access point ownership in Amazon EFS CSI Driver

CVE-2026-85656 - OS command injection in Amazon log4j-cve-2021-44228-hotpatch

CVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK

CVE-2026-84851- Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

CVE-2026-83551 - Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK

CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination

CVE-2026-81849 - Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

CVE-2026-81838 - Zip Slip path traversal in awsdac (diagram-as-code)

CVE-2026-78379 - Consent bypass in Strands Agents Tools python_repl tool

CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

CVE-2026-77810 - Issue with Athena Federated Query Neptune Connector

Issue with FreeRTOS-Kernel - CVE-2026-77234, CVE-2026-77235, CVE-2026-77236, CVE-2026-77237

CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

CVE-2026-75910 - Issue with Athena Federated Query Clickhouse Connector

CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service

CVE-2026-75897 - Uncontrolled resource consumption in OpenSearch Dashboards capabilities route

CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass

CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin

CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++

CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin

CVE-2026-19111 - Insecure direct object reference in Strands Agents Tools memory tools

CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

CVE-2026-18953 - Improper limitation of a pathname in AWS Transform MCP Server

CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows

CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation

CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools

CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands

CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

CVE-2026-18481 - Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

CVE-2026-18140 - Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

CVE-2026-16756 - Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Failure

CVE-2026-16317 and CVE-2026-16318: Issues with s2n-tls: an open-source implementation of the TLS/SSL protocols

CVE-2026-15957 - Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector

CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

CVE-2026-15738 - Issue with AWS Load Balancer Controller Cross-Namespace Traffic Interception via HTTPRoute/GRPCRoute Priority Ordering

CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL

CVE-2026-14904 - Improper Link Resolution in Auth.GetUserPrivateKey in AWS Research and Engineering Studio

CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

CVE-2026-14265- Deserialization of Untrusted Data in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

CVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib

CVE-2026-13769 – Insecure file permissions in AWS CLI

CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF

CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins

Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

CVE-2026-12530 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

CVE-2026-11931 - Insecure Permissions on Authentication Token Cache File in Kiro IDE

CVE-2026-12043 - Heap double-free in AWS Common Runtime aws-c-http

CVE-2026-10740 - Excessive memory allocation in s2n-quic

CVE-2026-10740 - Excessive memory allocation in s2n-quic

CVE-2026-11393 - Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent Import

CVE-2026-11400 and CVE-2026-11401

CVE-2026-10584 - HTTPS Fallback to HTTP in Graph Explorer

CVE-2026-10591 - Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths

CVE-2026-9291 - Insecure Deserialization in Amazon Braket SDK Job Results Processing

CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI

CVE-2026-9133 - Arbitrary file read in rabbitmq-aws plugin

CVE-2026-8838 - Remote Code Execution in amazon-redshift-python-driver

CVE-2026-8686 - Heap out-of-bounds read in coreMQTT MQTT5 property parsing

Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597)

Ongoing updates on Copy.fail and variants

Fragnesia Local Privilege Escalation report via ESP-in-TCP in the Linux Kernel

Dirty Frag and other issues in Amazon Linux kernels

CVE-2026-8178 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver