Free AWS Security Whitepaper
    Toc Consulting Logo
    AWS Security Digest·Week 40 of 2026·Sep 28 - Oct 4, 2026·11 items

    A CVSS 10.0 in AWS Labs' Loom and a SageMaker Unified Studio Credential Exposure

    Seven new AWS bulletins this week, led by a CVSS 10.0 authentication bypass in Loom, an AWS Labs agent orchestration platform, and a SageMaker Unified Studio flaw that, in projects with Trusted Identity Propagation enabled, could let a project contributor obtain another member's temporary role credentials. On the defensive side, Security Hub added remediation plans, GuardDuty can now be enforced through Organizations declarative policies, and CloudTrail now shows where data-event logging is missing.

    In this issue2critical3high2medium4info

    Highlights

    2 items
    $ tail -f /var/log/aws-security.log
    critical/CVE/

    CVE-2026-103956: Unauthenticated Admin Takeover of AWS Labs Loom, Plus Two SSRF Issues

    CVE-2026-103956CVE-2026-103957CVE-2026-103958Bulletin 2026-124-AWS

    Loom is an AWS Labs open-source AI agent orchestration platform. In versions before 1.6.1, a deployment with no identity provider configured gave any network client full administrative control of the agent control plane through any request to the application API, including registering tool servers, reading stored integration credentials and rewriting IAM role policies attached to managed agent roles (CVE-2026-103956, CVSS 3.1 10.0). This was fixed in 1.6.1, released August 4, 2026.

    Two further issues, fixed in 1.7.0, let an authenticated user with the mcp:write or a2a:write scope abuse outbound requests: CVE-2026-103957 could direct OAuth2 client secrets or another user's access token to a third-party endpoint, and CVE-2026-103958 could reach internal network locations, including the container's credential-vending endpoint, and read the responses.

    After upgrading, AWS recommends rotating OAuth2 client secrets used for MCP/A2A integrations, revoking and re-issuing access tokens active during the affected window, and, if container role credentials were accessed, rotating them and reviewing CloudTrail. Credited to Kenneth Cox via coordinated disclosure.

    Affected
    • Loom < 1.6.1 (CVE-2026-103956)
    • Loom < 1.7.0 (CVE-2026-103957, CVE-2026-103958)
    Fixed In
    • Loom 1.6.1 (CVE-2026-103956)
    • Loom 1.7.0 (all three)
    LoomIAM
    critical/CVE/

    CVE-2026-104019: SageMaker Unified Studio Space Startup Could Run Code in Another Member's Space

    CVE-2026-104019Bulletin 2026-125-AWS

    At startup, a SageMaker Space in SageMaker Unified Studio runs a network validation against every SageMaker connection in the project. Under certain conditions, connection details were not properly sanitized during this check, which could let arbitrary code run in another project member's Space. In projects with Trusted Identity Propagation enabled, a user with project contributor permissions or higher could obtain another member's temporary execution role credentials and call downstream TIP-enabled AWS services as that member.

    AWS has deployed the fix globally to all supported SageMaker Distribution versions (2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5 and 4.4.3); Spaces pick it up on their next restart. Lines 2.8.x-2.13.x and 3.3.x-3.8.x are end of support and receive no fix; 4.5.x is not affected.

    Affected
    • SageMaker Distribution 2.8.x-2.13.x, 3.3.x-3.8.x (end of support, no fix)
    • SageMaker Distribution 2.14.x < 2.14.12, 3.9.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, 4.4.x < 4.4.3
    Fixed In
    • SageMaker Distribution 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3 (restart Spaces)
    SageMaker

    CVEs & Vulnerabilities

    5 items
    $ cat /var/reports/CVE_REPORT.txt
    high/CVE/

    CVE-2026-97662: Argument Injection in security-agent-mcp-server Diff Scans

    CVE-2026-97662Bulletin 2026-121-AWS

    In security-agent-mcp-server, an open-source MCP server in the awslabs/mcp repository that AI assistants use to run local security scans, a crafted reference value passed to a diff scan was interpreted as a command-line option rather than a revision. A context-dependent actor could use this to create, overwrite or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace confinement.

    Affects 0.1.1 up to (not including) 0.2.0; fixed in 0.2.0. Until upgraded, AWS advises running diff scans only against trusted repositories, as a least-privileged user in an isolated environment. Credited to Mario Guzmán (yud4s) via coordinated disclosure.

    Affected
    • security-agent-mcp-server >= 0.1.1, < 0.2.0
    Fixed In
    • security-agent-mcp-server 0.2.0
    MCPAWS Security Agent
    high/CVE/

    CVE-2026-100308: Command Execution When GluonTS Deserializes an Untrusted Model

    CVE-2026-100308Bulletin 2026-119-AWS

    Deserialization of untrusted data in the model loading component of GluonTS, an open-source deep learning library for time series models, might let an attacker execute operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue applies whenever Predictor.deserialize() or any RepresentablePredictor.deserialize() is called on a model directory the user does not fully control.

    Affects GluonTS before 0.17.0; fixed in 0.17.0. AWS recommends deserializing only trusted model artifacts. Credited to Michael Holmquist (Hasp Labs) via coordinated disclosure.

    Affected
    • GluonTS < 0.17.0
    Fixed In
    • GluonTS 0.17.0
    GluonTS
    high/CVE/

    CVE-2026-104020: Deeply Nested Values Can Crash Amazon Ion Python

    CVE-2026-104020Bulletin 2026-122-AWS

    A crafted, deeply nested Ion value could make the Ion reader in Amazon Ion Python raise an error or crash the application, resulting in a denial of service.

    Affects Amazon Ion Python before 0.15.0; fixed in 0.15.0. As a workaround, AWS suggests disabling the C extension (simpleion.c_ext = False) and explicitly handling RecursionError raised from the simpleion module. Credited to Weiqi Wang and Lucas C. Cordeiro (University of Manchester) via coordinated disclosure.

    Affected
    • Amazon Ion Python < 0.15.0
    Fixed In
    • Amazon Ion Python 0.15.0
    Amazon Ion
    medium/CVE/

    CVE-2026-103505: Mount Option Injection in the Amazon EFS CSI Driver

    CVE-2026-103505Bulletin 2026-120-AWS

    In the Amazon EFS CSI Driver, an actor with PersistentVolume creation privileges could inject additional mount options through the mounttargetipmap volume attribute: comma-separated values appended inside that JSON map are parsed by the mount utility as separate mount options.

    Affects v3.1.0 through v3.4.2; fixed in v3.5.0. As a workaround, restrict PersistentVolume and StorageClass creation to cluster administrators with Kubernetes RBAC.

    Affected
    • Amazon EFS CSI Driver v3.1.0-v3.4.2
    Fixed In
    • Amazon EFS CSI Driver v3.5.0
    EFSEKS
    medium/CVE/

    CVE-2026-104002: Powertools for AWS Lambda (Python) Data Masking Failed Open

    CVE-2026-104002Bulletin 2026-123-AWS

    The data masking utility in Powertools for AWS Lambda (Python) handled errors by failing open, which might let actors read sensitive field values the application intended to mask. From the fixed version on, masking errors raise a DataMaskingError exception instead of returning the original value.

    Affects 3.6.0 through 3.34.0; fixed in 3.35.0. No workaround is available.

    Affected
    • Powertools for AWS Lambda (Python) 3.6.0-3.34.0
    Fixed In
    • Powertools for AWS Lambda (Python) 3.35.0
    Lambda

    Service Updates

    4 items
    $ aws securityhub get-findings --query 'ServiceUpdates'
    info/Feature Launch/

    Security Hub Remediation Plans Group Exposures by Root Cause

    AWS Security Hub now builds remediation plans that group related exposure findings sharing a root cause, so fixing one underlying resource, such as a misconfigured setting or an overly permissive policy, resolves or reduces the severity of several exposures at once. Each plan carries a Critical/High/Medium/Low priority, an impact assessment and step-by-step instructions with examples in AWS CLI, Terraform, CloudFormation, Python and CDK, and plans can be consumed through the API.

    Available in every Region where Security Hub is available, at no additional cost under the Security Hub Essentials plan.

    Security Hub
    info/Feature Launch/

    GuardDuty Enablement Can Now Be Enforced with AWS Organizations Declarative Policies

    From the delegated administrator account, you can now define a GuardDuty policy that sets an enablement baseline at the organization root, an OU or individual accounts, with a default for every Region where GuardDuty is available plus per-Region overrides. The policy applies to existing accounts and to new accounts as they join, and enablement set by a policy cannot be overridden through the GuardDuty console or API.

    Available in all commercial Regions and the AWS GovCloud (US) Regions.

    GuardDutyOrganizations
    info/Feature Launch/

    CloudTrail Event Coverage Shows Where Data-Event Logging Is Missing

    A new Event Coverage view in the CloudTrail console shows, at account and organization level, which services and resource types in your environment have data event logging enabled and which do not, and lets you subscribe to data events directly from the dashboard. Data events record data-plane operations, such as S3 object-level GetObject and PutObject calls, that help detect unauthorized data access or exfiltration attempts.

    Available in all commercial Regions where CloudTrail is supported.

    CloudTrail
    info/Compliance/

    AWS European Sovereign Cloud Will Run Disconnected from the AWS Backbone on October 24

    AWS announced that on Saturday, October 24, 2026, the AWS European Sovereign Cloud will operate for several hours without a connection to the AWS Global Network backbone, rerouting that traffic over the public internet through its dedicated European internet service providers. The dedicated system that manages controlled transfers of AWS operational data out of the EU will also be disabled for the exercise.

    AWS says service availability inside the AWS European Sovereign Cloud, other Regions and Direct Connect will not be affected, though customers may see brief connectivity disruptions as traffic changes route at the start and end. AWS says the exercise will produce verifiable technical and operational evidence of independent operation, and is designed to be consistent with the objectives of the European Commission's EU Cloud Sovereignty Framework and the criteria of the BSI C3A framework.

    AWS European Sovereign Cloud

    Key Takeaway

    1 item
    $ cat WEEKLY_SUMMARY.md

    Loom's worst bug needed nothing more than a request to a deployment with no identity provider configured. If you run any self-hosted agent control plane, AWS Labs or otherwise, confirm authentication is actually enforced before it is reachable beyond localhost, and treat any role it can rewrite as exposed until proven otherwise.

    Filed Under
    LoomSageMakerMCPGluonTSEFSLambdaSecurity HubGuardDutyCloudTrailEuropean Sovereign Cloud
    Previous
    Week 39 - Sep 21 - Sep 27, 2026
    Next
    Week 41 - Oct 5 - Oct 11, 2026

    Need Custom Security Briefings?

    These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.

    All DigestsSubscribe via RSSGet in Touch