CVE-2026-103958highCWE-918

CVE-2026-103958: falha de alta gravidade em AWS loom

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Publicada em · Atualizada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.3%
probabilidade de exploração
0.3%top 76% das CVEs
exploração observada
nãonenhuma fonte reporta
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
Produtos afetados
AWS · loom
CVEs relacionadas — AWS loom

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103956CRITICALMissing authentication for critical function in Loom for AWSEPSS 0.5%CVE-2026-103957HIGHServer-side request forgery in the OAuth2 discovery handling in Loom for AWSEPSS 0.4%
Referências
https://aws.amazon.com/security/security-bulletins/2026-124-aws/https://github.com/awslabs/loom/releases/tag/v1.7.0https://github.com/awslabs/loom/security/advisories/GHSA-w6g6-h8pv-6mc7