Vulnerability · Published Apr 30, 2026 · Assigned by AMZN

CVE-2026-7461OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials

High 7.2

In plain English

A high-severity OS command injection in Amazon ECS Agent from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username field in an ECS task definition. This issue requires permissions to register ECS task definitions or write to the Secrets Manager or SSM Parameter Store credentials used by the FSx volume configuration. To remediate this issue, users should upgrade to version 1.103.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/aws/amazon-ecs-agent	1.103.0	GHSA-fc67-c4hg-q653
Go	github.com/aws/amazon-ecs-agent	1.103.0	GO-2026-5353

Affected products (as reported)

Vendor	Product	Versions
AWS	Amazon ECS Agent	1.47.0 – through 1.102.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aws/amazon-ecs-agent/releases/tag/v1.103.0 patch
https://aws.amazon.com/security/security-bulletins/2026-024-aws/ vendor-advisory
https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-fc67-c4hg-q653 third-party-advisory