AWS Security Digest·Week 45 of 2026·Nov 2-8, 2026·22 items
A Babelfish Flaw Scored 9.8, an APT Bypass and 13 AWS Bulletins
Thirteen new AWS security bulletins through Saturday, November 7, the cut-off for this digest. The lead is Babelfish for Aurora PostgreSQL: a memory-safety issue in the SQL Server protocol handshake that a remote, unauthenticated actor can reach, scored 9.8, plus a privilege escalation in the same extension. Next come an APT flaw on Ubuntu and Debian hosts that AWS says you fix on each host with one command, and an EKS Network Policy Agent bug that might let an authenticated adjacent user bypass ingress rules. The rest is a long tail of open-source and tooling fixes, including a command injection in an AWS set-up example and a Redshift JDBC driver code-loading issue. On the defensive side, Amazon Inspector can now scan EC2 AMIs, IAM Roles Anywhere checks certificate revocation, and Security Hub gained an SBOM inventory.
In this issue2critical7high3medium10info
Highlights
3 items
$ tail -f /var/log/aws-security.log
critical/CVE/
Babelfish for PostgreSQL: Unauthenticated TDS Handshake Memory-Safety Issue Scored 9.8, Plus a Privilege Escalation in the Same Extension
Two AWS Security Bulletins cover Babelfish for PostgreSQL, the open-source extension that lets PostgreSQL, including Amazon Aurora PostgreSQL with Babelfish enabled, understand the SQL Server wire protocol (TDS). Bulletin 2026-166-AWS (published November 6) covers two memory-safety issues in the TDS layer. CVE-2026-119923, in the connection-handshake handling, could let a remote, unauthenticated actor affect the confidentiality, integrity and availability of the database process. CVE-2026-119924, in remote-procedure-call request handling, could let a remote, authenticated actor read adjacent process memory or cause a denial of service. Bulletin 2026-165-AWS (published November 3, updated November 6) covers CVE-2026-119922, an improper access control issue that may let remote authenticated users elevate their privileges.
AWS, as CNA, scores CVE-2026-119923 at 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, CVE-2026-119924 at 8.1 and 7.2, and CVE-2026-119922 at 8.8 and 8.7. NVD had these records in Received or Awaiting Analysis status when we checked on November 7.
The affected ranges cover Babelfish for PostgreSQL extension versions 1.0 to 5.4 (1.2 to 5.4 for CVE-2026-119922) and many Aurora PostgreSQL releases across the 1.x to 6.x Babelfish lines. The fix is extension versions 4.10, 5.6 and 6.1. For Aurora, the bulletins list a minimum Aurora PostgreSQL version for each line, for example 16.14.1 (Babelfish 4.10.0), 17.10.1 (5.6.0) and 18.4.1 (6.1.0), and say to apply pending maintenance so the cluster is on the latest patch.
What to check: find Aurora clusters with Babelfish enabled and compare their versions with the lists in the bulletins. For the TDS issues, the bulletin's workaround is to restrict network access to the TDS port (default 1433) to trusted sources with VPC security groups until you upgrade. Bulletin 165 says there is no workaround for CVE-2026-119922.
Affected
Babelfish for PostgreSQL extension 1.0 to 1.5, 2.1 to 2.15, 3.1 to 3.12, 4.0 to 4.8 and 5.1 to 5.4 (CVE-2026-119922: 1.2 and later)
Amazon Aurora PostgreSQL with Babelfish enabled, in the ranges listed in the bulletins
Fixed In
Babelfish for PostgreSQL extension 4.10, 5.6 or 6.1
Aurora PostgreSQL 16.14.1 (Babelfish 4.10.0), 17.10.1 (5.6.0), 18.4.1 (6.1.0) or later, with pending maintenance applied; other lines per the bulletin
AuroraRDS
high/CVE/
APT Flaw CVE-2026-109518 on Ubuntu and Debian: Run One Command on Each Host, Because Refreshed Image Dates Are Only Estimates
AWS Security Bulletin 2026-172-AWS (published November 5, updated November 6) covers CVE-2026-109518, an issue in the APT package manager on Ubuntu and Debian. When APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror can cause APT to install a package that did not pass verification, and the package's maintainer scripts then run with elevated privileges. Ubuntu 22.04 LTS and later and Debian 12 and later are affected in their default configuration. Canonical and Debian published updates on November 4 (USN-8996-1 and DSA-6607-1). The record shows a CVSS 4.0 score of 7.7 from the Ubuntu CNA and no 3.1 score, and NVD had not analyzed it.
The fixed APT versions are 2.4.15ubuntu0.1 on Ubuntu 22.04, 2.8.4ubuntu0.1 on 24.04 and 3.2.1ubuntu0.1 on 26.04, and Debian per DSA-6607-1. The bulletin gives one fix for a running host: update APT with retries turned off (apt-get update followed by apt-get upgrade with -o Acquire::Retries=0). AWS says this resolves the issue on that host immediately, including hosts launched from an image that does not yet contain the fixed package, and that a later refreshed image adds no protection to a host where you already ran it.
Customers running self-managed Ubuntu or Debian on EC2, including AWS-vended Ubuntu 22.04 AMIs, are responsible for the update, and container images need a rebuild and redeploy. Refreshed images are stated as estimates: DLAMI and PCS November 13, SageMaker HyperPod November 11, ParallelCluster 3.16.3 November 16 and the Cloud9 default image November 6 (expected; AWS had not confirmed it as of the last bulletin update). On Neuron DLAMIs based on Ubuntu 20.04 the fix requires Ubuntu Pro. AWS also recommends configuring APT sources over HTTPS, which reduces the conditions but does not replace the update, and says Amazon Inspector can identify affected EC2 instances.
Affected
Ubuntu 22.04 LTS and later, Debian 12 and later with HTTP package sources and retries enabled (default configuration)
Self-managed Ubuntu and Debian instances and container images on AWS
AWS Security Bulletin 2026-170-AWS covers CVE-2026-122266 in the Amazon EKS Network Policy Agent (aws-network-policy-agent), the open-source component of the Amazon VPC CNI that enforces Kubernetes NetworkPolicy on EKS. Improper isolation of shared eBPF connection tracking state might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods. AWS, as CNA, scores it 8.7 under CVSS 3.1 and 6.3 under CVSS 4.0; NVD had it in Received status when we checked.
The fix is aws-network-policy-agent 1.3.7 and the Amazon VPC CNI managed add-on 1.22.3. The bulletin says there are no workarounds. If you rely on NetworkPolicy for tenant isolation inside a cluster, upgrading the VPC CNI add-on is the action, and the bulletin does not describe a way to detect past bypasses.
Affected
aws-network-policy-agent before 1.3.7
Amazon VPC CNI managed add-on before 1.22.3
Fixed In
aws-network-policy-agent 1.3.7
amazon-vpc-cni-k8s 1.22.3
EKS
CVEs & Vulnerabilities
9 items
$ cat /var/reports/CVE_REPORT.txt
critical/CVE/
CVE-2026-122193: OS Command Injection in the Example SSM Documents of the Trusted Remote Execution (REX) Set-Up Guide
Trusted Remote Execution (REX) is an open-source framework for executing sandboxed scripts on managed instances, where a signed Cedar policy is meant to be the security boundary around each script run. The set-up guide contained an example script that creates two AWS Systems Manager documents, Rex-RO and Rex-RW. Because of how the example handled input parameters, a user with permission to invoke the document could supply crafted input that ran unintended operating system commands on the managed instance, outside the REX sandbox. The scriptArgs parameter is affected by the same class of issue.
The bulletin says this is not an issue in a shipped REX artifact version: it is an affected example in the documentation, and anyone who created the documents by following the guide is affected. AWS removed the example and recommends deleting the SSM documents in each account and Region where the example was run. There is no workaround. AWS, as CNA, scores it 9.9 under CVSS 3.1 and 9.3 under CVSS 4.0; NVD had it in Received status when we checked.
Affected
Any SSM documents Rex-RO and Rex-RW created by following the REX set-up guide example (not a shipped REX version)
Fixed In
Delete the SSM documents created from the example; the example was removed from the guide
Systems Manager
high/CVE/
CVE-2026-119084: Remote Code Execution Through Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Connection parameters of the Amazon Redshift JDBC Driver can lead to unsafe class loading and remote code execution in versions before 2.3.0. The fix is 2.3.0. The bulletin's workaround is not to build JDBC URLs or credentials profiles from untrusted input and to allowlist the values you accept. AWS, as CNA, scores it 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0; NVD had not analyzed it. The bulletin credits 4ra1n, pyn3rd and unam4.
Affected
Amazon Redshift JDBC Driver before 2.3.0
Fixed In
Amazon Redshift JDBC Driver 2.3.0
Redshift
high/CVE/
CVE-2026-119085: Template Injection in the Publishing Component of Virtual Engineering Workbench
A template injection issue in the publishing component of the open-source Virtual Engineering Workbench lets a user who can submit a crafted CloudFormation template body through the product versioning API run code with the permissions of the publishing Lambda function's IAM role, with access across all tenant projects. It affects all commits before c146486 (pull request 31, merged May 4, 2026); the fix is to redeploy from the main branch. The bulletin says no workaround removes the issue and suggests limiting who can create or update product versions. AWS, as CNA, scores it 8.8 under CVSS 3.1 and 9.4 under CVSS 4.0; NVD had not analyzed it. The bulletin credits Trung Nguyen of CyStack.
Affected
Virtual Engineering Workbench commits before c146486
Fixed In
Redeploy from main at commit c146486 or later
CloudFormationLambda
high/CVE/
CVE-2026-119083: GluonTS Writes Arbitrary Files While Extracting Archives
GluonTS, the open-source time-series modeling library, could write arbitrary files during archive extraction in versions before 0.17.0. The fix is 0.17.0. The bulletin's guidance is not to extract untrusted tar archives, and it notes that Python 3.14 or later applies the data extraction filter by default and blocks the link traversal. AWS, as CNA, scores it 7.8 under CVSS 3.1 and 8.4 under CVSS 4.0; NVD had it in Received status. The bulletin credits Udit Jain.
Affected
GluonTS before 0.17.0
Fixed In
GluonTS 0.17.0
GluonTSSageMaker
high/CVE/
CVE-2026-119301: Improper Neutralization of Quoting in Apache Iceberg SQL Identifier Generation in AWS SDK for pandas
In AWS SDK for pandas (awswrangler) versions 3.5.2 up to 3.17.1, an authenticated user with permission to modify Glue Data Catalog metadata could use a crafted column name to read any table that a more privileged principal can access and to write to the table being updated, through the Iceberg SQL identifier generation. The fix is 3.17.1, which the bulletin says was released on August 3, 2026. There is no complete workaround: avoid to_iceberg() with a principal more privileged than those who can modify the table's Glue Data Catalog metadata, and restrict glue:UpdateTable. AWS, as CNA, scores it 7.9 under CVSS 3.1 and 5.0 under CVSS 4.0; NVD had not analyzed it. The bulletin credits George Chen.
Affected
awswrangler >= 3.5.2 and < 3.17.1
Fixed In
AWS SDK for pandas 3.17.1
GlueAthena
high/CVE/
CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard
In Firecracker v0.23.0 through v1.16.1, under certain host memory conditions, a root user in a guest can read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device. AWS says AWS Lambda and other AWS services are not affected and no customer action is required, so this matters to operators who run Firecracker themselves.
The fix is v1.16.2 and v1.17.0. If you cannot upgrade, restore snapshots with the Uffd memory backend, and on kernels without the Linux 6.12 overcommit change use heuristic overcommit (vm.overcommit_memory=0) with the maximum discard size no greater than host RAM plus swap, and keep the memory cgroup OOM killer enabled. AWS says these measures do not prevent every replacement-mapping failure. AWS, as CNA, scores it 7.5 under CVSS 3.1 and 7.1 under CVSS 4.0; NVD had it in Received status. The bulletin credits Juan Pablo Martinez Kuhn of Coinspect.
Affected
Firecracker v0.23.0 through v1.16.1 (File memory backend with a balloon or virtio-mem device)
Fixed In
Firecracker v1.16.2 or v1.17.0
FirecrackerLambda
medium/CVE/
CVE-2026-116635: Path Traversal in the Deployment Status Component of the AWS Serverless MCP Server
The deployment status component of the AWS Serverless MCP Server, in versions before v0.2.1, allowed path traversal through traversal sequences or an absolute path in the project name input. It could read JSON files outside the deployment status directory and, if write access is enabled, write outside it. The fix is awslabs.aws-serverless-mcp-server v0.2.1, and the bulletin lists no workaround. AWS, as CNA, scores it 6.1 under CVSS 3.1 and 6.9 under CVSS 4.0; NVD had not analyzed it. The bulletin credits Syed Anas Mohiuddin.
Affected
awslabs.aws-serverless-mcp-server before v0.2.1
Fixed In
awslabs.aws-serverless-mcp-server v0.2.1
AWS Serverless MCP ServerLambda
medium/CVE/
CVE-2026-121652: Stored XSS in the Popup and Geofence Rendering of maplibre-gl-js-amplify
The AWS Amplify library maplibre-gl-js-amplify, in versions up to 4.0.2, had a stored cross-site scripting issue in popup and geofence rendering. The fix is 4.0.3, which adds HTML escaping. The bulletin says no workaround fully addresses it, and suggests sanitizing inputs and a restrictive Content Security Policy as defense in depth. AWS, as CNA, scores it 5.4 under CVSS 3.1 and 4.8 under CVSS 4.0; NVD had not analyzed it.
Affected
maplibre-gl-js-amplify 4.0.2 and earlier
Fixed In
maplibre-gl-js-amplify 4.0.3
Amplify
medium/CVE/
CVE-2026-120497: Stored XSS in the HTML Report Generator of aidlc-traceability in AWS AI-DLC Workflows
The HTML report generator of aidlc-traceability, part of the AWS AI-DLC Workflows project, had a stored cross-site scripting issue in versions from 0.1.0 until commit 96cf0ea (fixed July 3, 2026). The bulletin says the CLI was removed from awslabs/aidlc-workflows on July 16, 2026. Its guidance is not to open HTML reports from untrusted projects and to use Markdown output. AWS, as CNA, scores it 5.0 under CVSS 3.1 and 4.6 under CVSS 4.0; NVD had not analyzed it. The bulletin credits Vignesh Kumar.
Affected
aidlc-traceability from 0.1.0 until commit 96cf0ea
Fixed In
Commit 96cf0ea or later (the CLI was later removed from the repository)
Amazon Inspector Can Scan EC2 AMIs for Vulnerabilities Without Launching Instances
AWS says Inspector now scans EC2 Amazon Machine Images without launching instances, either continuously or as one-time scans from the EC2 console, and can be enabled per account or for an organization. For Security Hub customers AMI scanning is an add-on and findings go to Security Hub. The Allowed AMIs setting and Declarative Policies can enforce criteria, and EC2 Image Builder pipelines integrate with it. It is available in all commercial Regions where Inspector is available, and the announcement points to the Inspector pricing page for cost.
InspectorEC2
info/Feature Launch/
AWS Account Access Manager Assigns Existing IAM Roles to IAM Identity Center Users and Groups
An AWS Security Blog post introduces AWS account access manager, a new IAM capability that assigns existing IAM roles to IAM Identity Center users and groups through entitlements. According to the post, it keeps IAM role tags for attribute-based access control, trust policy conditions and role paths, uses trusted identity propagation to put the user context in each role session, and has its own API namespace, account-access, with its own permissions and CloudTrail events. The CLI uses aws login and needs AWS CLI v2.36.0 or newer. It requires an organization instance of IAM Identity Center and enabling it in the management account, and the post has a KMS customer managed key policy caveat when Identity Center is replicated to additional Regions. The post says it is available at no additional cost and enabled by default in commercial Regions, excluding opt-in commercial Regions, GovCloud (US), China and other non-commercial Regions.
IAMIAM Identity CenterCloudTrail
info/Feature Launch/
IAM Roles Anywhere Checks Certificate Revocation Automatically
IAM Roles Anywhere now reads the CRL distribution point URLs in authenticating certificates, downloads and periodically refreshes the revocation lists, and denies revoked certificates. AWS says it works with AWS Private CA or your own PKI if the distribution point URLs are publicly accessible, in all commercial Regions at no additional cost.
IAM Roles Anywhere
info/Feature Launch/
Security Hub Adds an SBOM Inventory for EC2, ECR Images and Lambda
Security Hub now provides a software bill of materials inventory for compute resources, built from Inspector SBOMs for EC2 instances, ECR images and Lambda functions. It is queryable through the API, included with Security Hub Essentials at no additional cost and available in all Regions where Security Hub is available.
Security HubInspector
info/Feature Launch/
Security Hub Network Scanning Is Now Available in AWS GovCloud (US)
Security Hub Network Scanning, which probes from the internet to test actual reachability and produces a finding per reachable port that feeds Exposures correlation, is now available in AWS GovCloud (US). AWS says it is on by default for new Security Hub customers and included with Security Hub Essentials at no additional cost.
Security Hub
info/Feature Launch/
EC2 Publishes an ImdsV1Enabled CloudWatch Metric to Track Instances That Still Allow IMDSv1
Amazon EC2 now publishes an ImdsV1Enabled CloudWatch metric that tracks instances still allowing IMDSv1. AWS says it is available in all Regions at no additional cost.
EC2CloudWatch
info/Feature Launch/
DataSync Enhanced Mode Supports OIDC for Google Cloud and Microsoft Azure Storage
DataSync Enhanced mode can now authenticate to Google Cloud and Microsoft Azure with OpenID Connect: the IAM role gets short-lived credentials from Google Cloud or Microsoft Entra ID, which avoids long-term HMAC keys or SAS tokens.
DataSyncIAM
info/Feature Launch/
AWS Config Supports 10 New Resource Types
AWS Config now supports 10 new resource types, among them AWS::Billing::BillingView, AWS::MPA::IdentitySource, AWS::ElastiCache::CacheCluster, AWS::ElastiCache::ReplicationGroup and AWS::Oam::Link. They are tracked automatically if you record all resource types, and are available in Config rules and aggregators.
Config
info/Feature Launch/
Amazon Cognito Plus Feature Plan Gets a 99.99% SLA
AWS announced a 99.99% availability SLA for the Cognito Plus feature plan, effective November 1, 2026, up from 99.9%. Essentials and Lite stay at 99.9%.
Cognito
info/Threat Intel/
DKIM Replay Attacks: Key Rotation Alone Does Not Stop a Signed Message From Being Resent
An AWS Security Blog post explains that in a DKIM replay attack a legitimately signed message is resent unchanged from attacker-controlled servers, so DKIM passes and DMARC passes even at p=reject, and rotating keys alone does not stop it. It suggests confirming replay from DMARC aggregate reports plus Amazon SES event data and recipient sample headers, getting to an enforcing DMARC policy first, and, after confirmed replay, removing the old selector TXT record (for bring-your-own DKIM) through Route 53.
SESRoute 53
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
Check two things first. If you run Aurora PostgreSQL with Babelfish, compare each cluster with the version lists in bulletins 165 and 166 and restrict the TDS port (default 1433) until you upgrade. If you run Ubuntu or Debian on EC2, update APT with retries off on each host, because AWS says a refreshed image adds no protection to a host where you already ran the command. Then look at the long tail: upgrade the VPC CNI add-on if you rely on NetworkPolicy, delete any Rex-RO or Rex-RW SSM documents created from the REX set-up guide, and move the Redshift JDBC driver to 2.3.0. This digest covers bulletins through Saturday, November 7. Bulletins 150 (eMudhra), 155 (Brotli) and 160 (Linux kernel) from earlier weeks show later update dates this week, so re-read them if you have not since November 1.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
