CVE-2026-103956

Katalog CVE

CVSS 10.0 · Critical EPSS 0,47%

Kerentanan Missing Authentication for Critical Function. Skor CVSS 3.1 10.0 (Critical) menurut CNA.

Deskripsi (NVD)

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

Rincian

Terbit di NVD

2 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

10.0 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-124-aws/
• https://github.com/awslabs/loom/releases/tag/v1.6.1
• https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp