AWS Security Digest·Week 44 of 2026·Oct 26 - Nov 1, 2026·17 items
Brotli on the CISA Exploited List, a Linux Kernel TCP Flaw and 10 AWS Bulletins
Ten new AWS security bulletins this week. The lead is CVE-2026-111497, a Brotli decoder flaw that NVD records as added to CISA's Known Exploited Vulnerabilities catalog on October 27, followed by a Linux kernel TCP flaw, CVE-2026-98432, that AWS says only a kernel update and reboot fully fixes, and a Private CA Connector for Kubernetes fix whose upgrade can stop certificate renewals. AI agent tooling appeared again: the AWS API MCP Server accepted OAuth tokens issued to other applications, and Strands Agents Tools let a model switch off secret masking. On the defensive side, AWS KMS gained ML-KEM and IAM Identity Center gained cross-Region trusted identity propagation.
In this issue2critical4high4medium7info
Highlights
3 items
$ tail -f /var/log/aws-security.log
critical/CVE/
Brotli Decoder Flaw CVE-2026-111497: On CISA's Exploited List, With Fixes Rolling Out Across Lambda, CodeBuild and Machine Learning Images
AWS Security Bulletin 2026-155-AWS (published October 28, updated November 5) covers CVE-2026-111497, a buffer overflow in the native Brotli decompression library that the bulletin says was first addressed in the Node.js October 2026 security releases. Decoding specially crafted Brotli-compressed input could let a third party run code or read process memory in an affected application. AWS says the issue affects Brotli decoding beyond Node.js and that fixes from other vendors are not yet fully available.
NVD describes it as a buffer overflow in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0 and scores it 9.8 under CVSS 3.1 (NVD primary score; the record is analyzed). NVD's record also shows the issue was added to the CISA Known Exploited Vulnerabilities catalog on October 27, with a due date of November 10 for US federal agencies.
AWS lists status per service. As of the November 5 update, the Lambda managed service is not affected, but the Node.js and .NET runtimes are, and AWS says they have been updated (Node.js 22.23.4, 24.22.2 and 26.13.0); container base images need a rebuild and redeploy. The Python, Ruby and OS-only runtimes do not include the Brotli library, so only functions that ship their own copy need redeploying. Amplify Hosting compute (server-side rendering) apps on Node.js 22 and 24 received the update automatically, and apps on earlier versions should migrate. App Runner deployed an updated runtime on October 26 and services need one redeploy, or a pin update first if they pin an older runtime. CodeBuild curated images are updated, and pinned or custom images must be updated or rebuilt. Elastic Beanstalk Node.js platform 6.11.12 was released on October 22. As of that update, several SageMaker components, Deep Learning Containers, PyTorch DLAMIs and CloudWatch Synthetics Python Selenium canaries were still listed as in progress.
What to check: if you run your own Node.js on EC2, ECS or EKS, the bulletin says you are responsible and should move to Node.js 22.23.4, 24.22.1, 26.12.1 or later. Because the issue extends to other languages, also check libraries, layers and images that bundle their own Brotli decoder, and disable Brotli decoding until a patch exists if none is available. If you cannot update at once, the bulletin gives an AWS WAF custom rule that matches the Content-Encoding: br request header, to be deployed in Count mode first. It inspects inbound requests only, blocks all Brotli-encoded uploads once set to Block, and AWS says it does not match every Brotli-encoded request. Node.js 18 and 20 no longer receive updates.
Affected
Google Brotli 1.0.3 through 1.2.0 (per NVD)
Node.js builds without the October 2026 security releases
AWS Lambda Node.js and .NET runtimes and container base images (updated by AWS)
Images and libraries that bundle their own Brotli decoder, such as pyarrow in Deep Learning Containers and PyTorch DLAMIs
Fixed In
Node.js 22.23.4, 24.22.1 or 26.12.1 or later (customer-managed)
Lambda Node.js runtimes 22.23.4, 24.22.2 and 26.13.0
Google Brotli 1.0.10, 1.1.1 or 1.2.1 per NVD
Elastic Beanstalk Node.js platform 6.11.12
pyarrow 26.0.1 or later where the bulletin lists it
AWS Security Bulletin 2026-160-AWS (published October 30 at 22:15 PDT, last updated November 6) covers CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path that affects kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third party can send crafted IPv4 TCP packets that carry IP options to an affected listener, which results in a kernel crash, disclosure of kernel memory or memory corruption. The bulletin says researchers have demonstrated unauthenticated remote code execution against hosts with a Multipath TCP (MPTCP) listener, and that AWS had no evidence of the issue being leveraged at that time. NVD lists a 9.8 score under CVSS 3.1 from a secondary source and had not analyzed the record when we checked on November 7.
AWS says a kernel update and reboot is the only complete remediation, and that customers running self-managed Linux on EC2 or Lightsail are responsible for it. Amazon Linux 2 and Amazon Linux 2023 kernel packages are available. Among the fixes the bulletin dates inside the week: EKS Auto Mode AMIs and Bottlerocket v1.68.1 on October 31, and Fargate and EKS Fargate platforms for tasks and pods launched after November 1 at 9:00 AM PST (5:00 PM UTC), as the bulletin states. It also names the EKS-optimized Amazon Linux 2023 AMI release v20261031 and the ECS-optimized AMI release 20261031 without giving a date, and says release-locked Amazon Linux 2023 instances need release 2023.12.20261102 (dated November 2). Ubuntu and other third-party kernels follow their vendors' fixes, and the bulletin said Canonical had not yet released one for Ubuntu. The bulletin has since grown to cover many more services, including self-service updates for ElastiCache and MemoryDB, and fixes for Elastic Beanstalk (November 4), CodeBuild, GameLift, Amazon MQ and AWS DMS that are dated after this week.
For edge services, AWS says AWS WAF, Application Load Balancer, Classic Load Balancer, TLS listeners on Network Load Balancer, CloudFront and API Gateway do not receive TCP connections from untrusted sources directly when best practices are followed, and AWS is updating their infrastructure. It still recommends updating self-managed instances behind them within 30 days. Global Accelerator drops IPv4 packets with IP options before processing, and Lambda is not affected. For customers who cannot update at once, the bulletin lists interim steps: disabling MPTCP, dropping packets that carry IP options with a firewall rule, or a stateful AWS Network Firewall rule (strict rule order required). AWS says disabling MPTCP reduces the conditions for running code but does not resolve the issue. The exact rules are in the bulletin.
Affected
Linux kernel 4.4 and later with an IPv4 TCP listener reachable by the sender
Amazon Linux 2 and Amazon Linux 2023 kernels before the fixed packages
Self-managed Linux on EC2, Lightsail and other AWS compute
Fixed In
Amazon Linux 2 and 2023 kernel packages (update and reboot)
EKS-optimized Amazon Linux 2023 AMI v20261031 or later
ECS-optimized AMI release 20261031
Bottlerocket v1.68.1
Fargate and EKS Fargate: new tasks and pods after November 1, 2026, 9:00 AM PST
AWS Security Bulletin 2026-156-AWS covers CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer), an external issuer for cert-manager that signs certificate requests with AWS Private Certificate Authority. In affected versions, under certain conditions, an authenticated user whose approval policy only authorizes a namespace-scoped issuer could obtain certificates, including subordinate CA certificates, signed by a cluster-scoped issuer they are not authorized to use. AWS, as CNA, scores it 8.5 under CVSS 3.1 and 8.4 under CVSS 4.0; NVD has not analyzed it.
The fix is aws-privateca-issuer v1.10.1 and the EKS add-on v1.10.1-eksbuild.1. The bulletin puts a warning before the upgrade: v1.10.1 enforces that issuerRef.kind is exactly AWSPCAIssuer or AWSPCAClusterIssuer and matches the kind of the issuer it references. Requests that relied on the earlier lenient resolution will stop renewing after the upgrade, and the services depending on them are affected when those certificates expire. A missing or incorrect kind, including kind: Issuer, which cert-manager sets for Ingress annotations that do not name an issuer kind, is now marked Failed. A request with kind: AWSPCAIssuer that references a cluster-scoped issuer stays Pending indefinitely.
What to check: before upgrading, audit your CertificateRequest, Certificate and Ingress resources and set issuerRef.kind explicitly to match the issuer. If you cannot upgrade yet, scope approval policies and RBAC rules to both the issuer name and the issuer kind.
Affected
aws-privateca-issuer before v1.10.1
AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1
Fixed In
aws-privateca-issuer v1.10.1
EKS add-on v1.10.1-eksbuild.1 (set issuerRef.kind explicitly before upgrading)
AWS Private CAEKS
CVEs & Vulnerabilities
7 items
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-115413: AWS API MCP Server Accepts OAuth Tokens Issued to Other Applications
The AWS API MCP Server is an open-source Model Context Protocol server that lets AI assistants interact with AWS through AWS CLI commands. It can serve the streamable-http transport with OAuth authentication. In versions 1.3.0 up to 1.6.0 it validates a token's signature, issuer and expiry but not the claim that identifies the application the token was issued for, so a token the configured identity provider issued to another application in the same tenant is accepted. That may allow AWS API calls to be made with the credentials configured on the host.
The fix is awslabs.aws-api-mcp-server 1.6.0. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito. The workaround is the default stdio transport. AWS, as CNA, scores it 7.8 under CVSS 3.1 and 7.3 under CVSS 4.0; NVD has not analyzed it.
Affected
awslabs.aws-api-mcp-server >= 1.3.0 and < 1.6.0 (streamable-http transport with OAuth)
Fixed In
awslabs.aws-api-mcp-server 1.6.0, with AUTH_AUDIENCE or AUTH_CLIENT_ID set
AWS API MCP ServerCognito
medium/CVE/
CVE-2026-115415: A Prompt-Injected Model Could Turn Off Secret Masking in the Strands Agents Tools environment Tool
The environment tool in Strands Agents Tools lets an agent list, read, set and delete environment variables on the agent host, and masks values that look like secrets by default. The tool accepted the masking parameter from the large language model through its tool schema. A crafted prompt delivered through content the agent is asked to process could instruct the model to call the tool with masking turned off, and the tool would then return the host's environment variables in cleartext, including cloud credentials and API keys, without asking the operator.
In strands-agents-tools 0.8.6 masking is controlled only by the operator and the environment tool is deprecated. AWS recommends rotating any credentials that were in the environment of agents that loaded the tool. If you cannot upgrade, remove the tool, avoid long-lived cloud credentials in the agent's environment and restrict outbound access to trusted endpoints. AWS, as CNA, scores it 6.5 under CVSS 3.1 and 5.9 under CVSS 4.0; NVD has not analyzed it.
Affected
strands-agents-tools >= 0.1.0 and < 0.8.6
Fixed In
strands-agents-tools 0.8.6
Strands Agents
high/CVE/
CVE-2026-115418: SQL Injection in the Redshift Custom Resource Handlers of the CDK aws-redshift-alpha Module
The @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. Crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting it requires the ability to influence the CDK application's construct property values.
The fix is version 2.274.0. After upgrading, AWS says to review existing table grants to PUBLIC. The workaround is to use only trusted, developer-authored values for user names, comments and passwords. AWS, as CNA, scores it 7.3 under CVSS 3.1 and 7.0 under CVSS 4.0; NVD has not analyzed it.
Affected
@aws-cdk/aws-redshift-alpha before 2.274.0-alpha.0
Fixed In
@aws-cdk/aws-redshift-alpha 2.274.0, then review table grants to PUBLIC
CDKRedshift
high/CVE/
CVE-2026-119116 and CVE-2026-119148: Use-After-Free and KMS Endpoint Injection in the AWS Nitro Enclaves SDK for C
CVE-2026-119116 is a use-after-free in the SetClient command handler of the kmstool-enclave example application. An application running on the parent EC2 instance could send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code within it. Only enclave images that include kmstool-enclave, or code derived from it, are affected. CVE-2026-119148 is an input validation issue in the SDK library: the AWS KMS server name is built from a caller-supplied region string, so a third party could supply a crafted region to impersonate KMS to the enclave and inject forged responses, such as actor-chosen key material.
Both are fixed in aws-nitro-enclaves-sdk-c v0.4.6, and customers must rebuild their enclave images. The bulletin says there are no workarounds. AWS, as CNA, scores CVE-2026-119116 at 7.8 and CVE-2026-119148 at 6.5 under CVSS 3.1; NVD has not analyzed either. The bulletin credits Trail of Bits for reporting CVE-2026-119116.
Affected
aws-nitro-enclaves-sdk-c v0.4.5 and earlier (CVE-2026-119116: kmstool-enclave only; CVE-2026-119148: the library)
Fixed In
aws-nitro-enclaves-sdk-c v0.4.6, then rebuild enclave images
Nitro EnclavesKMS
medium/CVE/
CVE-2026-118029: AWS SDK for pandas Did Not Verify Ownership of the Default Athena Query Result Bucket
In the Athena module of AWS SDK for pandas (awswrangler), unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller through a pre-created S3 bucket. The fix is version 3.16.1, which the bulletin says was released on May 8, 2026.
The workaround is to verify that the default Athena result bucket in each account and Region is owned by your own account, and to set an explicit result location or enforce a workgroup result configuration. AWS, as CNA, scores it 5.9 under CVSS 3.1 and 5.9 under CVSS 4.0; NVD has not analyzed it. The bulletin credits Dan Gansel of Upwind Security.
Affected
awswrangler before 3.16.1
Fixed In
AWS SDK for pandas 3.16.1
AthenaS3
medium/CVE/
CVE-2026-119117: Kinesis Producer Library for Java Wrote AWS Credentials to DEBUG Logs and to a Process Argument List
When the logger of the Amazon Kinesis Producer Library for Java is configured at DEBUG level, versions before 1.0.8 might let local users obtain the AWS credentials the library resolved for the application. Separately, affected versions pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list.
The fix is version 1.0.8, and users of the 0.x line must migrate to the software.amazon.kinesis package. Upgrading is the only complete fix. AWS also says to rotate long-term IAM user keys, revoke active role sessions where needed and redact or remove affected logs, and it recommends short-lived role credentials scoped to the stream. Interim steps: keep the Daemon logger above DEBUG (the bulletin gives the logger names) and drop log messages that begin with Starting Native Process; no configuration removes the credentials from the argument list. AWS, as CNA, scores it 6.5 under CVSS 3.1 and 8.2 under CVSS 4.0; NVD has not analyzed it.
Affected
com.amazonaws:amazon-kinesis-producer 0.15.12 and earlier
software.amazon.kinesis:amazon-kinesis-producer before 1.0.8
Fixed In
Amazon Kinesis Producer Library for Java 1.0.8
Kinesis
medium/CVE/
CVE-2026-119086: Missing Type Validation in xQueueSelectFromSet Lets an Unprivileged FreeRTOS Task Write Out of Bounds
FreeRTOS-Kernel, distributed by Amazon, does not fully validate that the object passed to the queue-set selection path is a queue set. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Builds without queue sets are not affected.
The fix is FreeRTOS-Kernel V11.3.3: rebuild and reflash affected firmware. AWS, as CNA, scores it 6.5 under CVSS 3.1 and 8.2 under CVSS 4.0; NVD has not analyzed it. The bulletin credits Claude (Anthropic) and Ada Logics, as written on the page.
Affected
FreeRTOS-Kernel V7.4.0 through V11.3.2 on MPU-enabled ports with configUSE_QUEUE_SETS=1
AWS KMS Adds ML-KEM Key Specs for Post-Quantum Key Encapsulation
AWS says KMS now supports ML-KEM, the NIST FIPS 203 post-quantum standard for establishing a shared secret, with all three key specs, ML-KEM-512, ML-KEM-768 and ML-KEM-1024. The Encapsulate API uses the public key to produce a random 32-byte shared secret and its ciphertext, and Decapsulate recovers the secret with the private key. KMS keeps the private key in FIPS 140-3 Level 3 validated HSMs, and GetPublicKey exports the public key for use in libraries such as AWS-LC, OpenSSL or Bouncy Castle. It is available in all Regions where KMS is available except Middle East (UAE), Middle East (Bahrain) and the China Regions.
KMS
info/Feature Launch/
IAM Identity Center Trusted Identity Propagation Now Works Across Regions
Trusted identity propagation carries a user's identity with a request so AWS services can grant permissions by user and group and log that user's access. AWS says it previously required all services that access the identity to be in the same Region, and that customers otherwise used broad IAM roles that cannot distinguish individual users or consolidated into one Region. With cross-Region support the identity context travels to services in other Regions. It is available at no additional cost in all Regions where IAM Identity Center is available.
IAM Identity Center
info/Feature Launch/
IAM Identity Center Identity Store Sends Change Events to EventBridge
The Identity Store now delivers events to Amazon EventBridge when users, groups, group memberships or the identity store itself are created, updated or deleted. AWS gives examples such as EventBridge rules that trigger Lambda functions to audit provisioning, send alerts to a SIEM or update downstream access. Events are sent in each enabled Region of the instance, and there is no cost beyond EventBridge usage.
IAM Identity CenterEventBridge
info/Feature Launch/
EKS Dashboard Shows Certificate Authority Rotation Status Across Clusters
The EKS Dashboard now shows CA rotation status across clusters, which clusters have CAs approaching expiration and upcoming automated rotation events. AWS says each EKS cluster has its own CA and that clusters created since 2018 have CAs with a 10-year validity period that are now approaching the point where rotation should begin. The dashboard aggregates across accounts and Regions through AWS Organizations, needs trusted access enabled in the management account, is viewed from US East (N. Virginia) and has no additional cost.
EKSOrganizations
info/Feature Launch/
AWS WAF Can Add Its JavaScript SDK Script Tag Automatically for CloudFront
With automatic SDK integration enabled, CloudFront adds the script tag for the AWS WAF JavaScript SDK to the HTML it serves, with no application code change. The SDK supplies client-side signals for three managed rule groups: Bot Control at the targeted inspection level, Fraud Control account takeover prevention and Fraud Control account creation fraud prevention. In the console the setting is on by default for new web ACLs with one of those groups; web ACLs created programmatically have it off, and existing ACLs are unchanged. There is no additional charge, and AWS points to the WAF Developer Guide for Content Security Policy guidance.
WAFCloudFront
info/Feature Launch/
Amazon MSK Provisioned Supports TLS 1.3 Through Named Security Policies
MSK Provisioned clusters can opt in to TLS 1.3 by choosing a named security policy, which defines the TLS version and cipher suites a cluster accepts. Connections that do not meet the policy are rejected. Policies that allow TLS 1.2 and 1.3 let clients negotiate the highest version they support, and stricter policies restrict connections to TLS 1.3 only. Existing clusters do not change until a policy is applied. It is available at no additional cost in all Regions where MSK Provisioned is available.
MSK
info/Feature Launch/
Aurora PostgreSQL 18 and Higher Adds Post-Quantum TLS Key Exchange Through ssl_groups
Aurora PostgreSQL-Compatible Edition now supports post-quantum TLS key exchange. On Aurora PostgreSQL versions 18 and higher you can modify the ssl_groups parameter and select cryptographic groups from the Aurora PostgreSQL allow list.
Aurora
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Check two things first. Anything that decodes Brotli: Node.js 22, 24 and 26 on hosts you manage, images built on Lambda or CodeBuild bases, and libraries that bundle their own decoder, because NVD records the flaw as added to CISA's exploited list on October 27. Then every self-managed Linux host that accepts IPv4 TCP connections: AWS says only a kernel update and reboot fully fixes CVE-2026-98432 (for non-Amazon distributions, follow the vendor's fix; Ubuntu was still pending at the last update). If you run cert-manager with the Private CA Connector, set issuerRef.kind explicitly before you upgrade or renewals may stop for requests that relied on the lenient resolution. Then look at the agent tooling: upgrade the AWS API MCP Server and Strands Agents Tools, and keep long-lived credentials out of agent environments.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
