Vulnerability · Published Oct 2, 2026 · Assigned by AMZN

CVE-2026-103956Missing authentication for critical function in Loom for AWS

Critical 10.0

In plain English

A critical-severity missing authentication in loom from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)2.5%top 15.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

Affected products (as reported)

Vendor	Product	Versions
AWS	loom	0 – before 1.6.1

Weakness: CWE-306, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/awslabs/loom/releases/tag/v1.6.1 release-notes, patch
https://aws.amazon.com/security/security-bulletins/2026-124-aws/ vendor-advisory
https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp third-party-advisory