Loom for AWS: Server-side request forgery and token disclosure in OAuth2 discovery
Summary
Loom for AWS, an open-source AI agent orchestration platform, contains a server-side request forgery (SSRF) flaw in its OAuth2 discovery handling. An authenticated user with the mcp:write or a2a:write scope can supply a crafted discovery URL that makes the backend send OAuth2 client secrets or another user's access token to a third-party-controlled endpoint. The same flaw can also make the application send requests to arbitrary internal network locations and read the responses. The CVE record rates the CVSS 4.0 base score at 8.2 (High); the vendor bulletin notes that the 1.6.1 release did not fully fix the token disclosure.
Affected
- Loom for AWS versions before 1.7.0 (AWS bulletin 2026-124-AWS)
Fixed in
- Loom for AWS 1.7.0 (fix commit 771cb3b5f5d8309fdd0165d0686e71be028ae0cd)
- Version 1.6.1 blocked internal-address reach for this code path but is not a complete fix.
Workaround
- Restrict the mcp:write and a2a:write scopes to trusted administrators only (for example the g-admins-super, g-admins-mcp, g-admins-a2a and g-admins-demo groups). This reduces the likelihood but does not close the issue without the code fix.
Exploitation
- No known exploitation. CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
- No public exploit code confirmed at the time of research.
Our recommendation
- Upgrade Loom for AWS to version 1.7.0 or later, including any forked or derivative code.
- Until the upgrade, limit the mcp:write and a2a:write scopes to trusted administrators.
- After the upgrade, rotate OAuth2 client secrets used for MCP and A2A integrations and revoke and re-issue active access tokens.
- If container role credentials may have been accessed, rotate the IAM role session credentials and review CloudTrail for unintended usage.
- Check CVE-2026-103956 (authentication bypass, fixed in 1.6.1) as well, since it is more critical and is fixed in the same deployment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-124-AWS aws.amazon.com
- Loom v1.7.0 release github.com
- GitHub Security Advisory GHSA-jcxf-gpf4-58hm github.com
- OSV entry CVE-2026-103957 osv.dev
- OpenCVE CVE-2026-103957 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:08.
Original description (NVD)
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.