Free AWS Security Whitepaper
    Toc Consulting Logo
    AWS Security Digest·Week 34 of 2026·Aug 17-23, 2026·9 items

    9,300 Leaked AWS Keys Are Still Live, Five Years Later

    Truffle Security reports that more than 9,300 of 10,616 re-tested leaked AWS keys still authenticate, 768 of them with full administrator or root access, some five years after first appearing publicly. Security Hub Extended adds Supply Chain Security as its tenth category. AWS also ships seven security bulletins this week, mostly across OpenSearch Dashboards and FreeRTOS-Kernel.

    In this issue1critical3high4medium1info

    Highlights

    2 items
    $ tail -f /var/log/aws-security.log
    critical/Threat Intel/

    9,300+ Leaked AWS Keys Still Authenticate, Truffle Security Finds

    Truffle Security re-verified 10,616 AWS keys it had found exposed in git history, Hugging Face datasets, Docker images, package registries, and CI logs between August 2022 and August 2026 - and 88% (more than 9,300) still worked as of August 10.

    Of those, 817 belonged to identifiable companies; 768 of those corporate keys carried full administrative control (526 root keys, 242 IAM users with AdministratorAccess). Among the subset of keys with an available creation date, the median age was about five years, and only 13.7% showed a newer key had since been issued - suggesting most had never been rotated.

    IAM
    info/Feature Launch/

    Security Hub Extended Adds Supply Chain Security as 10th Category

    AWS grew Security Hub Extended from 14 partners across 9 categories to 23 partners across 10, adding Supply Chain Security with Chainguard and Socket as the curated partners for the new category.

    Security Hub

    CVEs & Vulnerabilities

    7 items
    $ cat /var/reports/CVE_REPORT.txt
    medium/CVE/

    CVE-2026-75897: Denial of Service in OpenSearch Dashboards

    CVE-2026-75897Bulletin 2026-082-AWS

    The capabilities route handler in OpenSearch Dashboards does not bound request payload size, allowing a remote attacker to cause denial of service via a crafted HTTP request. Affects self-managed Dashboards 1.3.0-3.7.0 (including all 2.x through 2.19.6) and Amazon OpenSearch Service on multiple engine versions; fixed in Dashboards 3.8.0 or via the latest service software update. Amazon OpenSearch Serverless is not affected.

    Affected
    • OpenSearch Dashboards 1.3.0-3.7.0
    Fixed In
    • OpenSearch Dashboards 3.8.0
    OpenSearch
    medium/CVE/

    CVE-2026-75935 / CVE-2026-75936: Memory-Amplification DoS in Amazon Ion Java

    CVE-2026-75935CVE-2026-75936Bulletin 2026-083-AWS

    The ion-java library was vulnerable to two memory-exhaustion attacks: declared-length preallocation (CVE-2026-75935) and highly compressed data expansion (CVE-2026-75936). Configuring a maximum buffer size via IonBufferConfiguration.withMaximumBufferSize is a partial mitigation; the real fix is upgrading to ion-java 1.12.0.

    Affected
    • ion-java < 1.12.0
    Fixed In
    • ion-java 1.12.0
    Ion Java
    high/CVE/

    CVE-2026-75910: Athena ClickHouse Connector Could Leak Unrelated Secrets Manager Secrets

    CVE-2026-75910Bulletin 2026-084-AWS

    A privilege issue in the deployment template for the Athena Query Federation ClickHouse connector let an authenticated attacker point the connector's connection string at an unrelated secret and an attacker-controlled database endpoint, causing the connector to transmit that secret to the attacker. Fixed in v2026.17.1; redeploying with a non-empty SecretNamePrefix also mitigates.

    Affected
    • aws-athena-query-federation ClickHouse connector < v2026.17.1
    Fixed In
    • aws-athena-query-federation ClickHouse connector v2026.17.1
    AthenaSecrets Manager
    high/CVE/

    CVE-2026-18420: Prototype Pollution to RCE in OpenSearch Dashboards TSVB Plugin

    CVE-2026-18420Bulletin 2026-085-AWS

    Improper input validation in the Time Series Visual Builder (TSVB) plugin let an authenticated user with standard data access execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API. Affects Dashboards 3.0.0-3.7.x (open-source and AWS-managed); fixed in 3.8.0, or disable the TSVB plugin as an interim measure.

    Affected
    • OpenSearch Dashboards 3.0.0-3.7.x
    Fixed In
    • OpenSearch Dashboards 3.8.0
    OpenSearch
    high/CVE/

    Four FreeRTOS-Kernel CVEs: Privilege Escalation and Memory Corruption

    CVE-2026-77234CVE-2026-77235CVE-2026-77236CVE-2026-77237Bulletin 2026-086-AWS

    FreeRTOS-Kernel shipped four fixes together: CVE-2026-77234 (incomplete command validation in the software timer path lets an unprivileged task reach privileged code, affecting MPU-enabled ports 7.0.0-11.3.0); CVE-2026-77235 (missing privilege checks in TrustZone handling cause use-after-free by freeing a secure context still in use, versions 10.2.0-11.3.0); CVE-2026-77236 (inadequate size validation during secure-context allocation causes out-of-bounds writes into Secure-world memory, versions 10.2.0-11.3.0); and CVE-2026-77237 (missing type validation in queue-set operations causes out-of-bounds reads disclosing privileged memory, versions 7.4.0-11.3.0). All four are fixed in FreeRTOS-Kernel V11.3.1.

    Affected
    • FreeRTOS-Kernel 7.0.0-11.3.0 (range varies by CVE)
    Fixed In
    • FreeRTOS-Kernel V11.3.1
    FreeRTOS
    medium/CVE/

    CVE-2026-77810: Athena Neptune Connector Exposed Lambda Compute Properties

    CVE-2026-77810Bulletin 2026-087-AWS

    A user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda function supplying compute for the connector. Affects the Neptune connector v2024.15.1 through v2026.28.1; fixed in v2026.30.1. Mitigations include disabling query passthrough, restricting athena:StartQueryExecution on the Neptune catalog, and ensuring passthrough queries contain only Gremlin, openCypher, or SPARQL.

    Affected
    • Amazon Athena Federated Query Neptune Connector v2024.15.1-v2026.28.1
    Fixed In
    • Amazon Athena Federated Query Neptune Connector v2026.30.1
    Athena
    medium/CVE/

    CVE-2026-77811: Stored XSS via OpenSearch Dashboards Integrations

    CVE-2026-77811Bulletin 2026-088-AWS

    Improper input validation on the integrations static file endpoint let a remote authenticated actor with write permissions to Dashboards saved objects upload a custom integration containing arbitrary JavaScript, which then executes in the browser session of anyone who views it. Affects the dashboards-observability plugin before 3.4/2.19.6 and Amazon OpenSearch Service before 3.3; fixed in 3.4/2.19.6 and via service update.

    Affected
    • OpenSearch Dashboards dashboards-observability plugin < 3.4 / < 2.19.6
    Fixed In
    • OpenSearch Dashboards dashboards-observability plugin 3.4 / 2.19.6
    OpenSearch

    Key Takeaway

    1 item
    $ cat WEEKLY_SUMMARY.md

    The Truffle Security numbers are the real story: five-year-old, never-rotated, still-live keys with full admin rights are a bigger risk to most organizations than any CVE this week. If you have not run a credential-exposure sweep across git history, CI logs, and container images recently, this is the week to do it - then delete any root access keys you find, full stop.

    Filed Under
    IAMLeaked CredentialsSecurity HubOpenSearchFreeRTOSAthenaCVE
    Previous
    Week 33 - Aug 10-16, 2026
    Next
    Week 35 - Aug 24-30, 2026

    Need Custom Security Briefings?

    These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.

    All DigestsSubscribe via RSSGet in Touch