AWS Security Digest·Week 41 of 2026·Oct 5-11, 2026·14 items
Eight AWS Bulletins, Including a Cross-Account Athena Authorization Gap
Eight new AWS security bulletins this week, led by a code injection in the deprecated Bedrock AgentCore Starter Toolkit and a now-fixed Athena engine version 3 authorization gap that could have exposed query metadata across accounts. On the defensive side, GuardDuty RDS Protection now watches database query activity for exfiltration and destruction, and IAM Identity Center can restrict where Identity Store and SCIM API calls come from.
In this issue1critical2high5medium6info
Highlights
2 items
$ tail -f /var/log/aws-security.log
critical/CVE/
CVE-2026-105812: Code Injection via Crafted Agents Imported with the Bedrock AgentCore Starter Toolkit
bedrock-agentcore-starter-toolkit, an AWS-maintained Python CLI for importing Amazon Bedrock Agents into local development, could execute arbitrary code when a specially crafted agent was imported and then run or deployed (CVE-2026-105812). A second issue, CVE-2026-106032, in external reference handling could trigger unintended network requests or local file access during import.
Affects 0.1.4 through 0.3.13; fixed in 0.3.14. Agents imported with an affected version must be re-imported with 0.3.14 or later and their local and deployed output artifacts replaced. The toolkit has been deprecated since March 27, 2026; AWS recommends migrating to the AgentCore CLI (@aws/agentcore), which carries the equivalent fix. Credited to Koh Jun Sheng via coordinated disclosure.
Affected
bedrock-agentcore-starter-toolkit 0.1.4-0.3.13
Fixed In
bedrock-agentcore-starter-toolkit 0.3.14
Bedrock AgentCore
high/CVE/
CVE-2026-107352: Athena Engine v3 Authorization Gap Could Expose Query Metadata Across Accounts
Missing authorization checks in Amazon Athena engine version 3 request handling could have let an authenticated user read limited query metadata from other AWS accounts, specifically AWS account identifiers and SQL statement text. Query results, credentials and Amazon S3 data were not affected.
AWS fixed the issue service-side on September 1, 2026, and states it has confirmed no customer metadata was accessed. No customer action is required. Credited to Oren Yomtov of Act Security via coordinated disclosure.
Fixed In
Fixed service-side on September 1, 2026 (no customer action)
Athena
CVEs & Vulnerabilities
6 items
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-107322: OS Command Injection in the databases-on-aws Agent Plugin
In databases-on-aws, a plugin in Amazon Agent Plugins for AWS that provides database guidance and Aurora DSQL helper scripts for AI coding agents, an incomplete list of disallowed inputs could let a remote unauthenticated actor supply crafted content that an agent ingests. Command execution on the host happens only if the agent then invokes the local helper with the crafted database command value, and runs with the permissions of the helper process. The Aurora DSQL service itself is not affected and database privileges are not bypassed.
Affects 1.0.0 through 1.7.0; fixed in 1.7.1, available from the marketplace since August 26, 2026. Customers pinning a repository revision should use commit 8b13a503746a4ebb0402b936645163224058bde3 or later rather than a 1.7.1 release tag. Credited to Shay Sakazi via coordinated disclosure.
Affected
databases-on-aws 1.0.0-1.7.0
Fixed In
databases-on-aws 1.7.1
Aurora DSQLMCP
medium/CVE/
CVE-2026-105811: QnABot Amazon Q Business Lambda Hook Sample Could Read Any S3 Object in the Account
An authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample (q-business-lambda-hook) shipped with QnABot on AWS might let an authenticated remote user read arbitrary Amazon S3 objects in the deploying account. The sample is deployed separately and manually; customers who never deployed it are not affected.
Affects QnABot on AWS 7.0.0 up to (not including) 7.4.6. Update the QnABot stack to 7.4.6 or later and then redeploy the Lambda hook sample stack: updating the QnABot stack alone does not deliver the fix. Credited to Oren Yomtov via coordinated disclosure.
Affected
QnABot on AWS >= 7.0.0, < 7.4.6 (Amazon Q Business Lambda hook sample)
Fixed In
QnABot on AWS 7.4.6 + redeployed Lambda hook sample stack
QnABot on AWSAmazon Q BusinessS3
medium/CVE/
CVE-2026-108096: Amplify GraphQL Index Resolvers Could Return Other Users' Records
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer for SQL-backed models might let an authenticated remote user read records owned by other users of the same application through crafted queries.
Fixed in @aws-amplify/graphql-index-transformer 3.1.2, included in @aws-amplify/data-construct 1.17.4 and @aws-amplify/graphql-api-construct 1.21.4. After upgrading, redeploy the backend. No workaround is available.
AWS Tools for PowerShell before 5.0.306 inserted sensitive information into command output and log artifacts, which might let local users recover an IAM user's cleartext AWS Management Console password.
Affects 5.0.305 and earlier; fixed in 5.0.306. Until upgraded, AWS advises against using -WhatIf or -Confirm with cmdlets that take sensitive values as arguments.
Affected
AWS Tools for PowerShell <= 5.0.305
Fixed In
AWS Tools for PowerShell 5.0.306
AWS Tools for PowerShellIAM
medium/CVE/
CVE-2026-107332: AWS Toolkit for VS Code Left CodeCatalyst Tokens World-Readable
When a user connected to a CodeCatalyst Dev Environment, AWS Toolkit for Visual Studio Code cached the user's CodeCatalyst bearer token in a file with world-readable permissions and did not remove it when the session ended, so another local user or process on the same machine could read the token.
Affects versions before 4.10.0; fixed in 4.10.0, released July 9, 2026, which writes the file with owner-only permissions and deletes it when the Dev Environment stops.
Affected
AWS Toolkit for Visual Studio Code < 4.10.0
Fixed In
AWS Toolkit for Visual Studio Code 4.10.0
AWS Toolkit for VS CodeCodeCatalyst
medium/CVE/
CVE-2026-107608: Docker Bundling in aws-cdk-lib Could Insert Symlinks into Asset Output
When aws-cdk-lib bundled an asset with a Docker file, the Docker file could insert a symlinked file or directory into the bundling output even though that symlink was never provided as input to the bundling process.
Affects all aws-cdk-lib versions before 2.267.0; fixed in 2.267.0. If you cannot upgrade immediately, audit your Docker bundling containers and their dependencies to confirm no untrusted code runs inside the bundling environment.
GuardDuty RDS Protection Now Detects Data Exfiltration and Destruction
Amazon GuardDuty RDS Protection, previously focused on login anomalies, adds RDS Protection for data activity: ML-based anomaly detection and threat intelligence applied to database query patterns to flag data exfiltration and data destruction in Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL, with no agents or database configuration changes. It is an add-on to RDS Protection for login activity, with a 30-day free trial per account per Region.
Available in all commercial Regions and the AWS GovCloud (US) Regions where GuardDuty RDS Protection is offered with Aurora PostgreSQL and RDS for PostgreSQL support.
GuardDutyRDSAurora
info/Feature Launch/
IAM Identity Center Adds Network Access Controls for the Identity Store and SCIM APIs
You can now restrict where requests to the Identity Store API and the SCIM API may originate. For the Identity Store API, you can require allowed VPC endpoints in your account or organization, or specific source VPCs; for both APIs, you can allow only specific IP ranges, with different rules per API, for example VPC endpoints only for the Identity Store API while allowing SCIM from your external IdP's published IP ranges.
The controls are optional and off by default, requests AWS services make on your behalf are exempt, and configuration is done through the Identity Store API via the AWS SDKs and CLI.
IAM Identity Center
info/Feature Launch/
AWS Private CA Now Logs Full Certificate Content for Every Issuance
A new CloudTrail event, IssueCertificateDetails, delivered as a management event, records the complete to-be-signed certificate with all X.509 fields and extensions, the issuing CA, the requester identity and the signing status for every AWS Private CA issuance, including failures before signing such as name constraint violations. Previously, the IssueCertificate event confirmed only that the call succeeded and returned a certificate ARN.
The event is emitted automatically, with no opt-in and no cost beyond standard CloudTrail pricing; in cross-account setups it is delivered to the CA owner account.
AWS Private CACloudTrail
info/Feature Launch/
ACM ACME Certificate Issuance Now Works over AWS PrivateLink
AWS Certificate Manager now supports AWS PrivateLink for ACME public certificate issuance: after creating a managed ACME endpoint in ACM and an interface VPC endpoint, private DNS resolves your existing ACME directory URL to that endpoint, so ACMEv2 clients keep the same configuration while account creation, ordering, validation, finalization and retrieval traffic stays on the AWS network.
Available in all commercial Regions; standard PrivateLink interface endpoint charges apply.
ACMPrivateLink
info/Feature Launch/
Security Hub Can Export Findings to S3 as CSV or OCSF JSON
AWS Security Hub can now export findings on demand from every findings page in the console, including Threats, Exposure, Vulnerabilities, Posture Management, Sensitive Data and All Findings, to an S3 bucket in your account, as CSV or as JSON in OCSF format, for uses such as compliance reporting and audit evidence.
Available in all Regions where Security Hub is available.
Security HubS3
info/Service Update/
AWS Reports 89.0% End-to-End Score for AWS Continuum on CyberGym-E2E
AWS published benchmark results for AWS Continuum for code vulnerabilities, a multi-agent system covering vulnerability discovery, validation and remediation. On the public CyberGym-E2E benchmark (920 tasks drawn from historical OSS-Fuzz vulnerabilities across 139 open-source projects, 90-minute limit per task), AWS reports Continuum passed 819 of 920 tasks at the benchmark's main end-to-end stage, an 89.0% success rate versus a previous public high of 65.9%.
These are AWS's own reported results. AWS also notes the benchmark covers only memory-safety vulnerabilities in C and C++ projects, so many languages and bug classes are outside its scope.
AWS Continuum
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Two of this week's bulletins sit in AI agent tooling (the AgentCore Starter Toolkit and the databases-on-aws agent plugin), and the AgentCore one needs more than a version bump: agents imported with an affected toolkit version must be re-imported and their deployed artifacts replaced. If anyone on your team used the deprecated starter toolkit, find what it produced, rebuild it, and move to the AgentCore CLI.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
