Skip to content

amazonvrp

Public program information from HackerOne.

Current public scope

Verified public scope and policy

Historical research notes on this page are not verified authorization or current scope. Consult the linked public snapshot and the current HackerOne policy before testing.

Notes & Intelligence

  • 2026-10-27 — AWS bulletin 2026-152-AWS published 2026-10-27 11:00 PDT (live-verified against aws.amazon.com/security/security-bulletins 2026-10-27 ~18:45 UTC; index advanced 2026-151→2026-152-AWS):

  • 2026-152-AWS — CVE-2026-115413 (AWS API MCP Server OAuth token audience validation bypass; awslabs.aws-api-mcp-server >= 1.3.0 and < 1.6.0, fixed 1.6.0; Important): when the open-source AWS API MCP Server is configured with the streamable-http transport + OAuth authentication (bearer-token validation against an operator-nominated identity provider), the server validates the token's signature, issuer, and expiry — but NOT the audience claim identifying the application the token was issued for. A token the same IdP issued to any other application in the same tenant is therefore accepted, which may allow AWS API calls to be made with the credentials configured on the MCP host — cross-application token reuse inside one tenant escalates to the host's AWS privileges. Resolution: upgrade to 1.6.0 and patch forks; operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE (or AUTH_CLIENT_ID for IdPs whose access tokens carry no audience claim, e.g. Amazon Cognito — explicit call-out: Cognito default tokens are the exploitable shape). Workaround: fall back to the default stdio transport instead of streamable-http. Credited to Yuval Elbar (@YuvalElbar6) via coordinated disclosure. Bulletin references GHSA-4prq-p2x5-w9fh — not yet resolvable via the GitHub advisory API at check time (direct fetch 404, absent from sweep-76 since-poll; same bulletin-before-mirror lag pattern as GHSA-25hh-xvj4-2cqv from 2026-151; keep both tracked for mirror landing). Hunting read: token-audience-confusion now confirmed on an AWS-distributed MCP server — the MCP/agent-bridge lane (2026-149 sandbox validator, 2026-146 A2A state leak, 2026-140 Kiro cross-session) keeps producing, and this one names the exact class every OAuth validator can silently have: signature+issuer+expiry checks pass while aud goes unchecked, so tenant-internal app boundaries are the unprotected seam. Standing probe battery for any OAuth-protected agent/tool server: (1) does validation compare the audience against the server's own identity, (2) does the nominated IdP mint tokens for other apps in the same tenant (all enterprise IdPs do; Cognito defaults carry no aud at all), (3) what AWS privileges ride on the host accepting a foreign token — a same-tenant token from any sibling app is the credential. For VRP: awslabs.aws-api-mcp-server is AWS-distributed open source; a PoC replaying a sibling-app Cognito token against a streamable-http instance is directly reportable in the agent-tooling lane. Source: https://aws.amazon.com/security/security-bulletins/2026-152-aws/

  • 2026-10-27 — Strands Agents SDK local session-storage pair, GHSA-3w55-933p-8pv5 (CVSS 7.1) + GHSA-763v-5pjm-fx36 (no score assigned; strands-agents < 1.48.0, fixed 1.48.0; REVIEWED tier — first reviewed-tier advisories on this SDK, published 2026-10-27T15:34Z via advisory sweep-73, no AWS bulletin yet; index still 2026-151-AWS at check time): (a) FileSessionManager defaults to /tmp/strands/sessions/ (world-writable) with predictable paths and a write pattern (open(path+".tmp","w") → os.replace()) that follows symlinks — a local attacker pre-placing a symlink at the .tmp path achieves arbitrary file overwrite or injection of malicious session data for persistent prompt injection (no HMAC/signature on session files — tampered data loads as-is); (b) same default storage is world-readable under common umask 022 (dirs 0755, JSON 0644) on shared dev machines/CI hosts/notebooks/jump boxes/multi-user GPU servers, exposing persisted prompts, model output, tool inputs/outputs, and secrets passing through the agent. Hunting read: the Strands lane produces again (third AWS-Distributed-SDK advisory cluster after the 2026-146 A2A cross-tenant leak) but this time the impact class is local-filesystem trust — the durable lesson is that agent session persistence is a secret-bearing artifact deserving the same containment scrutiny as the agent runtime itself. Portable probe battery: (1) for any agent/LLM framework writing conversation state to a shared temp path, check dir/file modes and symlink-following in the write pattern, (2) check whether persisted session content is later loaded as trusted input (tampered session → persistent prompt injection is the escalation from local-write to remote-behavior), (3) on shared GPU/CI hosts, enumerate readable agent-session dirs under /tmp for other users' prompts/tool-output secrets. The tamper→persistent-injection chain is the reportable twist: a local-write primitive converts to model-behavior control without any network access. Source: https://github.com/advisories/GHSA-3w55-933p-8pv5

  • 2026-10-27 — Apache Airflow SSH provider remote-command injection, GHSA-v5m9-m7pg-q8f3 / CVE-2026-111422 (apache-airflow-providers-ssh < 7.0.1, fixed 7.0.1; caught in advisory sweep-71, unreviewed tier, no CVSS assigned at check time, published 2026-10-27T00:32:50Z): SSHRemoteJobOperator quotes the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script — so shell syntax such as $(...) in a value executes on the remote SSH host. In a DAG that passes trigger-time input (params / dag_run.conf) into environment, a user who can trigger the DAG but cannot author DAGs runs arbitrary commands on the remote host as the SSH connection's user. Fix: upgrade providers-ssh to 7.0.1+. Hunting read: double-quote-context escaping failure — the generator assumes single-quote sufficiency while embedding values in an outer quoted wrapper; same generator-injection lineage as 2026-145-AWS SAM CLI Makefile interpolation and 2026-151-AWS redshift-alpha SQL interpolation (third in the IaC/task-generator lane). The privilege delta is the payload: DAG-trigger (low trust) → remote-host RCE under a service SSH identity (high trust). Standing probe battery for any task/operator that renders templates into a shell command or wrapper script: (1) trace every quoting layer from template value to final shell — single-quote-then-embedded-in-quotes is breakable by $(...)/backticks, (2) enumerate which trigger-time inputs (params, conf, macros) reach the rendered command, (3) who holds trigger-only rights. Note: Apache project, not AWS-distributed software — VRP relevance via the AWS-integration surface, consistent with the 2026-10-20 providers-amazon SAML entry; both Airflow provider advisories in one week marks airflow provider-plugins as an active disclosure cluster. Source: https://github.com/advisories/GHSA-v5m9-m7pg-q8f3

  • 2026-10-26 — AWS bulletin 2026-151-AWS published 2026-10-26 09:30 PDT (live-verified against aws.amazon.com/security/security-bulletins 2026-10-26 ~21:45 UTC; index advanced 2026-150→2026-151-AWS):

  • 2026-151-AWS — CVE-2026-115418 (SQL injection in database-query custom resource handlers; aws-cdk/aws-redshift-alpha < 2.274.0-alpha.0, fixed 2.274.0; bulletin cites GHSA-25hh-xvj4-2cqv): the experimental CDK module that manages Amazon Redshift users/tables/privileges interpolates crafted user names, comments, or passwords set in construct properties into SQL that runs with Amazon Redshift SUPERUSER privileges at deployment time — including the ability to grant access to all cluster users. Exploitation requires the ability to influence the CDK application's construct property values (i.e. attacker-influenced IaC content). Resolution: upgrade to 2.274.0, patch forks, and review existing table grants to PUBLIC (the injection's likely blast marker). Workaround: trusted developer-authored values only. Credited to Joseph Semaan via coordinated disclosure. Note: the bulletin-referenced GHSA-25hh-xvj4-2cqv was not yet resolvable via the GitHub advisory API at check time (direct fetch returned no record, absent from sweep-69 since-poll) — expect the mirror to land in a later tier; bulletin remains authoritative. Hunting read: second IaC-generator injection in six days (sibling of 2026-145-AWS SAM CLI Terraform-hook command injection) — declared-infrastructure property values are attacker-influenced input to a SQL generator executing with the deployer's highest privilege. The standing probe battery for any CDK/construct/CR that emits SQL or shell from property values: (1) is any interpolated token quoted/escaped for the target language, (2) who can author or influence property values in the pipeline (external contributor? template param? imported resource name?), (3) what privilege does the generated statement execute under at deploy time. For VRP: aws-redshift-alpha is AWS-distributed npm code — a public PoC proving superuser grant escalation from a low-trust template value is a reportable vector in the IaC-supply-chain lane. Source: https://aws.amazon.com/security/security-bulletins/2026-151-aws/

  • 2026-10-25 — AWS bulletin 2026-150-AWS published 2026-10-24 20:00 PDT (live-verified against aws.amazon.com/security/security-bulletins 2026-10-25 ~05:45 UTC; index advanced 2026-149→2026-150-AWS):

  • 2026-150-AWS — CVE-2026-111943 (eMudhra intermediate CA key recovery in AWS trust bundles): cryptographic key-generation failure at an external CA (eMudhra/emSign) — catastrophic entropy failure in P-384 key generation left eight intermediate CA private keys (six TLS, two code-signing) generated with small-integer scalar values, trivially mathematically recoverable. AWS-owned TLS trust bundles (used by AWS services to validate outbound TLS to customer-configured endpoints: IdP endpoints, origin servers, webhook destinations) contained roots chaining to the affected intermediates: AAA Certificate Services, emSign Root TLS CA-G3, emSign ECC Root CA-G3 (SPKI SHA-256 fingerprints published in the bulletin). Affected intermediates revoked by the issuing CA 2026-10-18 and the cross-signing CA 2026-10-19 — clients with fail-closed OCSP/CRL checking were never exposed. Root removal deployed to the live shared AWS trust store 2026-10-21; botocore ≥1.43.117, AL2/AL2023 ca-certificates updates, and updated Corretto JDKs available now; CloudFront edge CA bundle removal targeting 2026-10-28; Bottlerocket AMIs 2026-10-26→10-28; ALB OIDC/JWT IdP trust stores being updated 2026-10-29→10-31, customers whose IdP certificate chains to an affected root must replace it by 2026-10-28 (else TLS validation failure); STS/Cognito done; RDS SQL Server 2026-10-30; EMR 2026-10-31. Related ALAS IDs: CVE-2026-113470, CVE-2026-111943. No GHSA mirror found via API cve_id lookup (external CA + service-side root removal, no AWS artifact advisory). Hunting read: third-party trust-anchor compromise class with a hard operational cliff — during the removal window, any in-scope Amazon service that validates customer/IdP certs is mid-transition; ALB OIDC/JWT and CloudFront origin validation are the observable surfaces where mis-mitigation shows as auth failures (informational disclosure value) or where a service still trusts a revoked root past its stated deadline (real finding). Also durable: low-entropy CA keygen is the one supply-chain class where the defender's root store becomes the attack surface — check what roots YOUR targets pin. Source: https://aws.amazon.com/security/security-bulletins/2026-150-aws/

  • 2026-10-23 — AWS bulletins 2026-148/149-AWS published (live-verified against aws.amazon.com/security/security-bulletins 2026-10-23 ~23:45 UTC; lowercase slug URLs …/security-bulletins/2026-1NN-aws/):

  • 2026-148-AWS — CVE-2026-115812 & CVE-2026-115813 (Amazon Web Services Multi Model Server, all released versions <= 1.1.11, EOL — NO FIX EVER): (a) relative path traversal during model archive extraction — a crafted model archive writes files outside the extraction dir → code execution with MMS process privileges (CVSS 9.8 GHSA-3v4f-xjg3-3j32); (b) SSRF in the model download path — the management interface can be directed to request unintended network destinations (CVSS 5.8 GHSA-g55x-6xv3-fpjr). In both cases the MMS management interface requires NO authentication; deployments binding it to a network-accessible address are at elevated risk. MMS repo archived/read-only since 2025-11-20 — migration is the only resolution; fork maintainers must reject archive entries resolving outside the extraction dir and allowlist model-download URLs. SageMaker-style shipped config binds management to all interfaces on the same port as inference, so the loopback workaround is unavailable there. Credited to Sujal Tuladhar. Hunting read: an unauthenticated management plane + archive-extraction traversal in an EOL model server still widely deployed via container images = fingerprint-and-hunt surface; the archive-unpacking-without-path-containment class is portable to every model/artifact upload path in scope (any service that unpacks user-supplied archives server-side). Also the durable lesson: EOL open-source served in production images is where unfixable 9.8s live — banner-grab MMS/model-server ports in recon. Both GHSAs caught in the 2026-10-23 evening advisory sweep (unreviewed tier, published 18:31Z, mirrored the bulletin). Source: https://aws.amazon.com/security/security-bulletins/2026-148-aws/
  • 2026-149-AWS — CVE-2026-115845 (AWS MCP Server, managed service): incomplete disallowed-input list in the Python code validator of the run_script sandbox — an authenticated remote user escapes to arbitrary code execution within their own isolated session environment via a crafted script. Fixed service-side, no customer action. Credited to Manash Saikia. Hunting read: sandbox-escape-by-validator-blocklist-incompleteness in AWS's own MCP offering — the seventh entry in the AI-agent tooling lane and the first where the impact scope is explicitly self-session only (containment held; the isolation boundary, not the sandbox, did the protecting). The durable probe: any "safe script" tool that validates by blacklist rather than capability restriction is bypassable — enumerate what the validator does not name. For VRP reporting, note AWS scoped impact to the caller's own session, which reads as sandbox-escape-within-authorization; cross-session/privilege-escalation evidence would be what raises such a report's value. No GHSA mirror (managed service, no distributed artifact). Source: https://aws.amazon.com/security/security-bulletins/2026-149-aws/

  • Batch meta-note: two-bulletin evening wave, both AI/model-serving infra (EOL MMS archive traversal + MCP sandbox validator bypass) — the agent/model-serving lane produced 3 of the last 6 AWS bulletins (146, 148, 149); continue treating model-serving and agent-protocol surfaces as the highest-yield VRP lane.

  • 2026-10-23 — AWS bulletins 2026-144/145/146/147-AWS published (live-verified against aws.amazon.com/security/security-bulletins 2026-10-23 ~07:45 UTC; lowercase slug URLs …/security-bulletins/2026-1NN-aws/):

  • 2026-144-AWS — CVE-2026-115416 (Amazon Athena engine version 3): incorrect authorization checks in query processing allowed an authenticated user to read AWS account identifiers and SQL statement-text query metadata from other AWS accounts (cross-tenant metadata disclosure; query results and S3/source data were NOT accessible). AWS remediated server-side October 7, 2026 — no customer action required, no workarounds. GHSA mirror GHSA-4774-8498-749g (unreviewed tier, CVSS 7.7 listed by bot) caught in the 2026-10-23 advisory sweep. Note the 90+-day disclosure lag (fix 10-07, bulletin 10-22/23) — server-side service bugs surface in the advisory feed long after remediation; treat advisory-tier Athena authz hits as historical, not live. Cross-tenant query-metadata leak via a shared query engine is a fresh anchor for the managed-service tenant-isolation lane (same family as the Athena engine-v3 authz pair of 10-07 and the Amplify generated-resolver entry). Source: https://aws.amazon.com/security/security-bulletins/2026-144-aws/
  • 2026-145-AWS — CVE-2026-115414 (AWS SAM CLI >= 1.63.0 <= 1.166.1, fixed v1.166.2): OS command injection in the Terraform hook (sam build --hook-name terraform): the hook generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters — an actor who can influence the Terraform configuration or plan file consumed by a build executes arbitrary commands as the build user. Workaround: only trusted TF config/plan files; audit third-party modules and shared repos feeding the build. Hunting read: this is the IaC-supply-chain mirror of the template-injection class — declared-infrastructure identifiers are attacker-influenced input to a code generator that emits shell. Standing probe battery for any generator that emits build files (Makefile, CI yaml, Dockerfile) from upstream config: (1) is any interpolated token shell-quoted, (2) can an external contributor choose resource/module names, (3) what does the build user have access to. Continues the deploy-pipeline lane (2026-141 CICD toolchain IAM-overgrant, GitLab downstream-pipeline family). Directly VRP-relevant (AWS-distributed open-source tooling). Source: https://aws.amazon.com/security/security-bulletins/2026-145-aws/
  • 2026-146-AWS — CVE-2026-115419 (Strands Agents SDK A2A server; Python strands-agents < 1.43.0, TS strands-agents/sdk < 1.5.0; GHSA-4v6f-7vjh-6x4m): the Agent2Agent HTTP server did not isolate conversation state between callers — an authenticated remote user could read another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. Fix isolates conversation state per context_id; NO full workaround — until upgrade, one A2A server instance per user/tenant. Hunting read: sixth confirmation of the AI-agent session/attribution-confusion class (Kiro Crew 2026-140, GitLab CVE-2026-96893 lineage) and now the first with confirmed cross-tenant READ of conversation state — agent-protocol servers (A2A, MCP bridges) treat a shared state key as tenancy boundary. The durable probe for any agent-server bridge: send two concurrent sessions with distinct identities, then check whether responses/history/behavior leak across the context boundary. Multi-agent infra is now a repeatedly-confirmed VRP lane on AWS-distributed SDKs. Source: https://aws.amazon.com/security/security-bulletins/2026-146-aws/
  • 2026-147-AWS — CVE-2026-115417 (aws-c-mqtt >= 0.9.1 < 0.16.2, fixed v0.16.2; GHSA-g3x5-86mr-65p5): memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter — remote actor → DoS of the client process (bundled in AWS IoT Device SDK for C++ v2). Mitigations: trusted brokers only (AWS IoT Core enforces negotiated max packet size), TLS to block on-path tampering of broker responses, prefer native MQTT5/3.1.1 clients over the compat adapter. Credited to Eunho Kim via coordinated disclosure. Hunting read: client-side DoS via broker response = the unsolicited/trusted-response allocation class (same shape as the FreeRTOS-Plus-TCP DNS reply-source entry) — anywhere a client allocates from a length field supplied by the "server" without a negotiated cap. Compat/legacy adapter layers inside modern libraries are a discrete attack surface: newer native paths enforce limits the legacy shim skips. Source: https://aws.amazon.com/security/security-bulletins/2026-147-aws/

  • Batch meta-note: four-bulletin day; three of four (SAM CLI hook injection, Strands A2A state leak, aws-c-mqtt compat-adapter alloc) are bugs in AWS-distributed open-source tooling/SDKs, not the managed service plane — the toolchain/supply-chain lane continues to out-produce the service plane for reportable VRP surface.

  • 2026-10-22 — AWS bulletins 2026-142/143-AWS published (live-verified against aws.amazon.com/security/security-bulletins 2026-10-22 ~07:45 UTC; lowercase slug URLs …/security-bulletins/2026-1NN-aws/):

  • 2026-142-AWS — CVE-2026-112408 (Amazon SageMaker Python SDK V2 < 2.257.3, V3 >= 3.0.0 < 3.10.0; GHSA-5rx8-8fr2-f855 per bulletin; publication date 10/21/2026 12:30 PM PDT): the SDK's default_bucket() uses a predictably named S3 bucket and never verifies the caller's AWS account owns it — a remote actor who creates that bucket name first (bucket-squatting) achieves code execution in the victim's remote SageMaker execution environment and obtains its IAM credentials. Fix: 2.257.3 / 3.10.0; workaround: set an explicit default_bucket on sagemaker.Session or SDK config instead of the auto-generated name. Credited to Dan Gansel (Upwind Security) via coordinated disclosure. Hunting read: classic cloud resource-name-preemption class (same family as S3 bucket squatting / subdomain takeover) now confirmed inside an ML-SDK default — any SDK/CLI that auto-derives storage resource names without ownership verification is a squat-to-RCE lane; the durable probe battery: (1) is the resource name predictable from account-external inputs, (2) does the consumer verify ownership before trusting content, (3) what runtime privileges does the trust boundary carry (here: SageMaker execution-role IAM creds). Directly VRP-relevant (AWS-distributed SDK) — and portable: hunt predictable-bucket/container/registry names in every program with SDK-generated infrastructure. No global GHSA mirror was visible via advisory API at sweep-47 check time — bulletin remains authoritative. Source: https://aws.amazon.com/security/security-bulletins/2026-142-aws/

  • 2026-143-AWS — CVE-2026-109618 & CVE-2026-109619 (PHP web runtimes, CRITICAL): two unauthenticated remote-code-execution issues in PHP reachable by crafted web requests against PHP workers (code execution, process-data read, or DoS; bounded to the affected worker, no established cross-customer propagation). Affected: PHP 8.5.0–8.5.11 (fix 8.5.12), 8.4.0–8.4.26 (fix 8.4.27), 8.3.0–8.3.35 (fix 8.3.36), 8.2.0–8.2.34 (fix 8.2.35); PHP 5.4–8.1 EOL with NO upstream fix planned — migration only. AWS states AWS services themselves are not impacted; customer-facing surfaces with mitigation status: WorkMail (config controls applied, PHP 8.3.36 upgrade targeted 2026-10-22), Elastic Beanstalk PHP platform v4.13.12 released 2026-10-21 (follow-on with upstream fix targeted 10-22), Amazon Linux updated PHP packages (non-commercial regions 10-22), Lightsail updated blueprints. AWS WAF compensating controls published for interim. Hunting read: this is the ecosystem story, not a VRP report vector (AWS says services not impacted) — but two internet-facing unauth PHP RCEs with EOL branches left unfixed is a fingerprinting goldmine: any in-scope target banner-fingerprinted on PHP ≤ 8.1, or 8.x below the fixed points, is sitting on a known unauth RCE while the disclosure goes public — expect mass scanning within days and adjust passive-recon watchlists accordingly; for report-quality evidence on owned labs, this is a rare legal validation surface for PHP request-handling sinks. Sources: https://aws.amazon.com/security/security-bulletins/2026-143-aws/

  • 2026-10-20 — AWS bulletins 2026-140/141-AWS published (live-verified against aws.amazon.com/security/security-bulletins 2026-10-20 ~20:45 UTC; lowercase slug URLs …/security-bulletins/2026-1NN-aws/; no GHSA mirrors found via advisory API for either CVE at check time):

  • 2026-140-AWS — CVE-2026-112380 (Kiro Crew < 0.7.2): authorization issue in the WhatsApp channel + internal subagent run-control endpoints of Kiro Crew, AWS's open-source personal AI agent that runs tools on the operator's machine. Where an operator had added a WhatsApp group to whatsapp.groups (or set whatsapp.dm_policy to open), any member of that group could send instructions to another session's subagent, which then executed them on the operator's machine under that session's approval policy — with the audit trail attributed to the operator, not the actual sender. Default config is NOT affected (whatsapp.groups empty, dm_policy=self, unlisted groups dropped pre-dispatch). Fix in 0.7.2 (PR #14338): group traffic now subject to the same per-user allowlist as DMs (deny-by-default), untrusted turns run on a dedicated tool-less agent, and every subagent run-control route requires verified caller identity + ownership check. Mitigation without upgrade: empty whatsapp.groups / keep dm_policy=self, or disable the WhatsApp channel. Hunting read: cross-session subagent instruction injection with operator-attribution laundering — the fifth confirmation of the AI-agent attribution-confusion class (GitLab CVE-2026-96893 sibling) and the first on an AWS-distributed agent framework; the durable probe battery for any messaging-channel agent bridge: (1) does channel traffic cross session boundaries, (2) is sender identity verified per run-control route or only at channel attach, (3) whose identity does execution get logged under. Channel-allowlist config = privilege boundary — test deny-vs-allow dispatch order. Directly VRP-relevant (AWS-distributed software). Source: https://aws.amazon.com/security/security-bulletins/2026-140-aws/

  • 2026-141-AWS — CVE-2026-112407 (AWS CICD-toolchain-for-serverless-applications < 1.0.11): incorrect privilege assignment in the toolchain's IAM policy lets a remote authenticated user with push access to the application source repository escalate privileges and access/modify resources outside the application stack in the same AWS account via application templates deployed by the pipeline. Fixed in 1.0.11; AWS recommends upgrading existing stacks and patching forks. Credited to an external researcher (Changli, Xidian University) via coordinated disclosure. Hunting read: continues the standing deploy-pipeline IAM-overgrant lane (same meta-class as GitLab CVE-2026-16301 downstream-pipeline execution and the GitLab CI protected-variable family): repo-push is a much lower trust level than what a pipeline's role can reach — for any IaC/CI template that provisions its own pipeline roles, diff the pipeline role's policy against the minimum the declared app needs, and test whether template content is a caller-controlled input to the IAM policy generator. Sample-app-grade bugs matter: the same pattern ships in customer-built toolchains. Source: https://aws.amazon.com/security/security-bulletins/2026-141-aws/

  • 2026-10-20 — Apache Airflow Amazon provider AWS auth manager SAML login-CSRF, GHSA-2738-4g2m-64cv / CVE-2026-86467 (apache-airflow-providers-amazon < 9.38.0): the SAML login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo → an unauthenticated attacker who lures a victim to an attacker page can complete a SAML login in the victim's browser using the attacker's own assertion, silently landing the victim in an Airflow session the attacker controls (subsequent victim work lands in the attacker's session). No victim Airflow credential needed. Fix: providers-amazon 9.38.0. Published 2026-10-20T03:32Z, unreviewed tier — no CVSS assigned; confirm against the Apache list thread before relying on severity (refs: apache/airflow PR 73698, lists.apache.org thread). Note: Apache project, not AWS-distributed software — VRP relevance is via the AWS auth-manager integration surface, not a direct AWS report vector. Hunting read: missing InResponseTo binding is now a confirmed repeat class — same login-CSRF fixed in the Keycloak auth manager as CVE-2026-40948 is explicitly cited; every SAML SP that skips assertion→request binding is probeable via victim-lure. Standing checklist addition: for any SSO/SAML integration, test whether the callback rejects assertions whose InResponseTo is absent or foreign.

  • 2026-10-19 — AWS bulletins 2026-131/132-AWS folded in (live-verified against aws.amazon.com/security/security-bulletins 2026-10-19 ~23:45 UTC; bulletin pages do not expose publish dates in static HTML, so treat as recent, published before the 133–139 batch of 10-17/18):

  • 2026-131-AWS — CVE-2026-107608 (aws-cdk-lib < 2.267.0, GHSA-h6j4-qpp7-q28p per bulletin references, no global GHSA mirror found via API 10-19): when CDK asset bundling is invoked with a Dockerfile, the Docker build can insert a symlinked file/directory into the bundling output without that symlink ever being an input to the bundling process → unintended files smuggled into deployed CloudFormation asset artifacts. Fix: aws-cdk-lib 2.267.0; workaround: audit that no untrusted code executes inside the bundling container. Hunting read: build-output canonicalization — a trusted pipeline stage (asset bundling) trusts its container's filesystem output, so the container becomes the smuggling channel; same trust-boundary meta-class as the Amplify generated-resolver entry (trust what the generator emits, not the declared intent).
  • 2026-132-AWS — CVE-2026-107783 (AWS Tools for PowerShell ≤ 5.0.305, fixed 5.0.306, GHSA-q3x5-q6rm-c7p3 per bulletin references, no global GHSA mirror found via API 10-19): an IAM user's cleartext Management Console password can be recovered from command output and log artifacts (notably when -WhatIf/-Confirm is used with cmdlets carrying sensitive arguments). Local-user recovery, but the leaked secret is a console credential, not a token. Hunting read: same lineage as the SageMaker SDK stderr→CloudWatch leak (2026-134) — the SDK tooling layer echoes full argument vectors into logs/what-if previews; any cmdlet/CLI wrapper that prints "what it would have run" with embedded credentials is a standing probe class across SDK tooling in VRP scope.

  • Batch meta-note: both are dev-tooling-layer bugs (CDK bundler, PowerShell tools), not service-plane — AWS keeps crediting toolchain supply-chain issues steadily; watch the SDK/CLI/ IaC lane in addition to service endpoints.

  • 2026-10-19 — vmgenid driver NULL-deref on Firecracker snapshot-restore path, GHSA-p8pc-3hw3-fwp9 / CVE-2026-98841: Linux kernel virt: vmgenid driver: both probe paths register the generation-changed notification handler before assigning driver_data, which the handler dereferences. The advisory explicitly names Firecracker snapshot restore as the trigger — the VMM can inject the generation-changed notification while restoring a guest whose snapshot predates driver probe, so the IRQ fires with driver_data still NULL → kernel panic (NULL deref @ offset 0x10). The IRQ is also IRQF_SHARED, so a line-sharing device can trigger the handler just as early. Fix: set driver_data before registering handlers (kernel stable commit linked in the advisory). Published 2026-10-18T18:32Z, unreviewed-tier kernel-bot GHSA mirror — no CVSS/GHSA severity assigned; no AWS bulletin yet (live-verified against the GitHub advisory API 2026-10-19). Hunting read: rare advisory that names a VMM behavior as the trigger — the snapshot/restore lifecycle of microVMs is a fresh race window for guest-kernel init bugs; if probing Firecracker-adjacent VRP surfaces (snapshot/restore features, warm-start), guest-boot-ordering bugs triggered by VMM-injected events are a live class. Local/guest-side DoS primitive (panic at probe), so posture intel, similar to the nitro_enclaves entry below.

  • 2026-10-18 (later same day) — Nitro Enclaves kernel-driver use-after-free, GHSA-8pj3-87fr-9h94 / CVE-2026-98775: Linux kernel nitro_enclaves driver error path: when SLOT_ALLOC fails after anon_inode_getfile() succeeded in ne_create_vm_ioctl(), the cleanup calls fput(enclave_file) then frees ne_enclave; ne_enclave_release() later dereferences ne_enclave->slot_uid on the freed object → KASAN slab-use-after-free reachable by any local user with access to the enclave device node. Fix: clear enclave_file->private_data before fput() (kernel stable commits linked in the advisory). Published 2026-10-18T18:32Z via the unreviewed tier — kernel-bot GHSA mirror, no CVSS/GHSA severity assigned; no AWS bulletin yet — confirm against NVD/kernel stable before relying on impact claims. Hunting read: extends the same-day virtio-net guest→host lane to the enclave boundary, and the bug class is generic error-path ownership (cleanup order between file-release and struct-free) — probe any ioctl that installs a file descriptor before fully validating allocation. Local-primitive only (needs /dev/nitro_enclaves access on an instance the customer controls), so VRP relevance is posture intel rather than a direct report vector.
  • 2026-10-18 — AWS bulletins 2026-137/138/139-AWS published overnight (live-verified against aws.amazon.com/security/security-bulletins 2026-10-18; bulletin URLs use lowercase slug form …/security-bulletins/2026-1NN-aws/):
  • 2026-137-AWS — CVE-2026-99999 (Linux kernel virtio-net/TAP): privileged guest-VM actor sends crafted packets → host kernel memory corruption on KVM-based hypervisors running unpatched kernels 4.4–6.18 → host memory disclosure or DoS. AWS-managed compute (EC2, Lambda, Fargate) explicitly NOT affected — exposure is self-managed VM hosts, including Firecracker-based VMMs; fixed via Amazon Linux kernel updates (AL2/AL2023, kernel 6.18.51+ etc.). Credited to Paulos Yibelo (pwn.ai). Hunting read: guest→host boundary via the networking virtio path — for any sandbox/microVM product in VRP scope (Lambda-style isolation, Fargate, third-party Firecracker deployments), the packet-shaped-input-to-host-kernel class is a fresh cross-boundary template; also note AWS's public "not affected" attestation pattern for managed services — useful framing for report impact statements.
  • 2026-138-AWS — CVE-2026-109587 / CVE-2026-109588 (FreeRTOS-Kernel Arm Cortex-R82 MPU port): unprivileged task escapes its MPU region on buffer args to MPU system calls (authorization gap), plus a length-truncation in stream-buffer buffer validation → unprivileged read/write of privileged kernel memory. Affects V11.3.0/V11.3.1 with configENABLE_MPU=1; fixed V11.3.2. GHSA mirrors: GHSA-pv9j-rq42-3fjc, GHSA-qf4j-6f5j-876g. Credited to Ada Logics + Anthropic. Hunting read: the MPU system-call buffer authorization check itself is the vulnerable component — sandbox-enforcement code is attack surface, same meta-lesson as the GitLab regex-compiler wave.
  • 2026-139-AWS — CVE-2026-102551 / CVE-2026-102552 (FreeRTOS-Plus-TCP ≤ V4.4.1, fixed V4.4.2): IPv6 Router Advertisement handler doesn't verify the RA is on-link → remote third-party can steer the device's IPv6 gateway/prefix/address → traffic interception (reachable in default config with IPv6+RA enabled). DNS resolver accepts replies without validating source == queried server → DNS cache poisoning. Notable: the DNS fix is opt-in (ipconfigDNS_CHECK_REPLY_SOURCE_IP, disabled by default) — upgrading alone does NOT remediate, a rare "patched but still vulnerable by default" case worth quoting in IoT/OT-adjacent reports. GHSA mirrors: GHSA-pjq5-fqrr-g6pv, GHSA-h4fw-pv82-p7h5. Credited to Cipher / Causal Security. Hunting read: source-verification-of-unsolicited-replies (RA, DNS, any request/response pair lacking tokens) is the class — off-path injection into stateless protocol handlers.
  • Cumulative hunting-read for the batch: three of three bulletins this week are boundary-validation failures in enforcement/trust code (hypervisor network path, MPU syscall guard, protocol source checks) rather than feature bugs — continues the same meta-pattern as the GitLab regex-compiler and Amazon Amplify generated-resolver entries.
  • 2026-10-07/08 — two service-side authorization advisories collected (unreviewed tier): missing authorization checks in Amazon Athena engine version 3 request handling (CVE-2026-107352, GHSA-f7xp-x469-c8c2) and an authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook (CVE-2026-105811, GHSA-r223-2773-wq4w). Recorded as source-backed public intel from the 2026-10-08 advisory sweep; both are unreviewed-tier mirrors — confirm against the live advisory and AWS service bulletins before relying on them. Hunting-read value: the Q Business record is another anchor for the standing user-controlled-key/parameter authz probe class (checklist 22 lineage) on managed services with customer-extensible hooks.
  • 2026-10-14/15 — AWS bulletins 2026-133/134/135-AWS: three advisory classes folded into the standing hunt lanes (live-verified against aws.amazon.com/security/security-bulletins 2026-10-18):
  • 2026-133-AWS — CVE-2026-108096 (Amplify API Category): improper authorization in query resolvers generated by @aws-amplify/graphql-index-transformer — an authenticated user can read records owned by other users of the same app via crafted queries on AppSync APIs built from declared auth rules. Hunting read: when authorization is code-generated from a declarative schema, the generated resolver is the enforcement point — authz-rule → resolver compilation gaps are a systematic probe class for any schema-to-API generator, not just Amplify.
  • 2026-134-AWS — CVE-2026-110248 (SageMaker Python SDK): on failed Git clone, repo credentials in subprocess error output are written unredacted to CloudWatch Logs; log readers get plaintext creds. Hunting read: the error path is the leak path — subprocess/CLI wrapper stderr is a standing credential-disclosure probe wherever tools echo commands with embedded auth into logs.
  • 2026-135-AWS — CVE-2026-110310 (S3 Encryption Client for .NET): a remote user able to read encrypted objects can downgrade the padding scheme recorded in object metadata to legacy RSA PKCS#1 v1.5, then exploit the resulting Bleichenbacher padding oracle to recover the wrapped envelope key and decrypt. Hunting read: metadata-trusted crypto negotiation (client reads attacker-influenced algorithm fields) is the root class — cross-boundary impact from an object-read-only principal to plaintext recovery.
  • All three extend the managed-service authz/crypto-boundary lineage above (Q Business user-controlled key, Neptune Gremlin). No GHSA mirrors found in the GitHub advisory API for these CVEs as of 2026-10-18 — AWS bulletins are the authoritative source.
  • 2026-10-15 — Amazon Neptune Gremlin deserialization RCE advisory (critical tier): GHSA-6rrf-xw64-h782 / CVE-2026-110812, CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Deserialization of untrusted data in the Gremlin graph data import component of the Neptune engine; an authenticated remote actor with standard database permissions can reach arbitrary code execution and internal service credential access. Fix: engine 1.5.0.0 (backports to 1.4.8.x and 1.4.7.x); AWS bulletin 2026-136-AWS verified live 2026-10-17. Collected via the 2026-10-14 unreviewed-tier advisory sweep — a managed-service authz-boundary case: low-priv DB user → cross-boundary impact (scope-change to service credentials), same lineage as the Q Business user-controlled-key anchor above. Hunting-read value: import/parse paths on customer-supplied graph data are a live RCE + credential-theft surface even behind standard auth.
  • 2026-10-11 — program-status verification (public page re-check). Read-verified against the public program page: paid bounty program with a published reward table in the \(500–\)30k range and Fast Payment participation. Triage bar is mature — expect strict duplication and quality screening. Page also confirms the program remains publicly visible. Generated public-scope.md stays authoritative for scope.