CVE-2026-103958highCWE-918

CVE-2026-103958: high-severity vulnerability in AWS loom

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
Affected products
AWS · loom
Related CVEs — AWS loom

In the same product, most dangerous first.

CVE-2026-103956CRITICALMissing authentication for critical function in Loom for AWSEPSS 0.5%CVE-2026-103957HIGHServer-side request forgery in the OAuth2 discovery handling in Loom for AWSEPSS 0.4%
References
https://aws.amazon.com/security/security-bulletins/2026-124-aws/https://github.com/awslabs/loom/releases/tag/v1.7.0https://github.com/awslabs/loom/security/advisories/GHSA-w6g6-h8pv-6mc7