The issuer resolution logic in the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 does not correctly enforce authorization. An authenticated user whose approval policy only permits a namespace-scoped issuer may obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer they are not authorized to use. The attack requires valid cluster credentials and low privileges.
Amazon Web Services · AWS Private CA Connector for Kubernetes
Amazon Web Services Multi Model Server (MMS) 1.1.11 and earlier contains a relative path traversal flaw during model archive extraction. A remote attacker can supply a crafted model archive that writes files outside the intended directory, potentially executing arbitrary code with the privileges of the MMS process. The management interface does not require authentication, and deployments that expose it to a network are at increased risk. MMS is end of life and no fixed version is available.
Amazon Web Services · Multi Model Server
The Agent2Agent (A2A) server component of the Strands Agents SDK for Python and TypeScript does not properly isolate conversation state between callers. An authenticated remote user can read the conversation history of other callers and add persistent instructions that change model behavior for later callers, by using a different context_id in HTTP requests. The issue matters most in multi-tenant deployments where one A2A endpoint serves more than one user or tenant.
Amazon Web Services · Strands Agents SDK
AWS SAM CLI versions 1.63.0 up to 1.166.1 contain an OS command injection in the Terraform hook (sam build --hook-name terraform). A Terraform resource address is inserted without full neutralization into a generated Makefile recipe. An attacker who can influence the Terraform configuration or plan file processed by a build can run arbitrary commands as the build user on the build host, without AWS credentials. The flaw affects local build processes and is not exposed directly to the internet.
Amazon Web Services · AWS SAM CLI
The SageMaker Python SDK does not verify that the caller's AWS account owns the predictably named S3 bucket it uses by default. A remote attacker who pre-creates that bucket can achieve code execution in the SageMaker execution environment and obtain IAM credentials. The CVSS 4.0 score is 9.4 (Critical); CISA SSVC lists exploitation as none and automatable as no, and no public exploit is known.
Amazon Web Services · SageMaker Python SDK
The AWS sample CI/CD toolchain for serverless applications, versions 1.0.7 through 1.0.10, assigns incorrect privileges in its IAM policy. An authenticated user with push access to the application source repository can deploy templates through the toolchain pipeline to escalate privileges. This can allow access to or modification of resources outside the application stack in the same AWS account.
Amazon Web Services · CICD-toolchain-for-serverless-applications
In FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 MPU port, a numeric truncation in the buffer length check of a stream buffer system call can allow an unprivileged task to read or write privileged kernel memory beyond the validated buffer window. The attacker needs code execution as an unprivileged task on the device, so the flaw is local and not reachable from the network. It only applies to MPU-enabled builds (configENABLE_MPU=1).
Amazon Web Services · FreeRTOS-Kernel
FreeRTOS-Plus-TCP, a TCP/IP stack for embedded and IoT devices, does not properly verify that IPv6 Router Advertisements come from an on-link source before acting on them. A remote attacker can send a crafted Router Advertisement to change the device's IPv6 default gateway, on-link prefix and address configuration, which may allow interception of its IPv6 traffic. The issue is reachable in the default configuration where IPv6 and Router Advertisement processing are enabled, and no authentication or user interaction is required according to the CVSS vector.
Amazon Web Services · FreeRTOS-Plus-TCP
Amazon Neptune, AWS's managed graph database service, contains a deserialization flaw in the Gremlin graph import path, tracked as CVE-2026-110812. An authenticated user with standard Neptune query (neptune-db) permissions can submit a crafted request that makes the query engine process untrusted input unsafely. The CVE record states this could allow code execution and access to internal service credentials. Exploitation requires valid database credentials, and AWS has fixed the issue in patched engine versions.
Amazon Web Services · Amazon Neptune
The databases-on-aws plugin in Amazon Agent Plugins for AWS does not fully filter disallowed inputs in the psql helper command path. An attacker who gets crafted content into an AI coding agent's context can cause the agent to run the local helper with a malicious database command value, which executes arbitrary operating system commands with the permissions of the helper process. The affected code is not a listening network service, so exposure is mainly on hosts where the agent and plugin run. NVD rates the issue CVSS 4.0 8.5 (High) and the status was Awaiting Analysis at the time of review.
Amazon Web Services · Agent Plugins for AWS (databases-on-aws)
