CVE-2026-103956

Missing authentication for critical function in Loom for AWS

State: Published
Severity: 10.0 Critical
Published: Oct 2, 2026
Updated: Oct 9, 2026
Reserved: Oct 1, 2026

Description

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.

To remediate this issue, users should upgrade to version 1.6.1 or later.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	AMZN
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	AMZN

Weaknesses

CWE-306 Missing authentication for critical function
CWE-1188 Initialization of a resource with an insecure default

Affected Products

Product	Versions
loomAWS	before 1.6.1Affected

References

https://github.com/awslabs/loom/releases/tag/v1.6.1release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-124-aws/vendor-advisory
https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mpthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.