Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Loom for AWS lets anyone become super‑admin

CVE-2026-103956 · published 16 days ago
Summary

The Loom for AWS software (versions before 1.6.1) does not check who is making certain requests, so anyone on the network can gain full administrative control of the system. This could let an attacker add servers, view stored credentials, and change permission settings. Upgrade to version 1.6.1 or newer to fix the problem.

What to do
  • Update aws loom to version 1.6.1 or later.
Affected software
VendorProductAffected versions
aws loom < 1.6.1
Original advisory text
Missing authentication for critical function in Loom for AWS
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.



To remediate this issue, users should upgrade to version 1.6.1 or later.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-103956 · NVD
CVE-2026-103956 · MITRE
CVE-2026-103956 · OSV
GHSA-vgmj-998f-r8mp · GHSA
Track software like this
Free during beta