CVE-2026-103957highCWE-201CWE-918

CVE-2026-103957: falha de alta gravidade em AWS loom

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.4%
probabilidade de exploração
0.4%top 70% das CVEs
exploração observada
nãonenhuma fonte reporta
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
AWS · loom
CVEs relacionadas — AWS loom

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103956CRITICALMissing authentication for critical function in Loom for AWSEPSS 0.5%CVE-2026-103958HIGHServer-side request forgery in the tool server and remote agent connection handling in Loom for AWSEPSS 0.3%
Referências
https://aws.amazon.com/security/security-bulletins/2026-124-aws/https://github.com/awslabs/loom/releases/tag/v1.7.0https://github.com/awslabs/loom/security/advisories/GHSA-jcxf-gpf4-58hm