Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.2

AWS Ops Wheel allows attackers to steal session tokens

CVE-2026-18481 · published 3 months ago
Summary

An attacker can steal session tokens from an authenticated user's AWS Ops Wheel account, potentially allowing them to gain full control of the account. This is a serious security risk, especially if users have sensitive information or access to critical systems. To fix this, update to the latest version of AWS Ops Wheel.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
aws aws ops wheel <= PR168
Original advisory text
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative co...
Stored cross-site scripting in the participant URL handling in AWS Ops
Wheel before PR #168 might allow an authenticated remote user to steal
session tokens and escalate to full administrative control of the
deployed instance via a crafted participant_url value containing a
dangerous URI scheme.






To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.2 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Jul 2026
Updated4 Nov 2026
First seen31 Jul 2026
Sources
CVE-2026-18481 · NVD
CVE-2026-18481 · MITRE
Track software like this
Free during beta