AWS Loom for AWS: Server-side request forgery in tool server and remote agent connections
Summary
Loom for AWS before version 1.7.0 contains a server-side request forgery (SSRF) flaw in the handling of tool server (MCP) and remote agent (A2A) connections. An authenticated user with the mcp:write or a2a:write scope can supply a crafted connection address and make the application send requests to arbitrary internal network locations, including the container's credential-vending endpoint. The attacker can read the responses, which may expose the application's container role credentials and internal services.
Affected
- AWS Loom for AWS versions below 1.7.0
Fixed in
- Version 1.7.0 (addresses this issue)
- Note: version 1.6.1 does not fully address this issue
Workaround
- Restrict the mcp:write and a2a:write scopes (group memberships g-admins-super, g-admins-mcp, g-admins-a2a, g-admins-demo) to trusted administrators only. This reduces the likelihood but does not fully close the issue without the code fix.
Exploitation
- Authentication required: the attacker needs a user with the mcp:write or a2a:write scope.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not known to be exploited; no public proof-of-concept confirmed at the time of writing.
Our recommendation
- Identify all Loom deployments and their versions.
- Upgrade all instances to version 1.7.0 or later and apply the fix to any forks.
- Treat instances below 1.6.1 as urgent, because of the related CVE-2026-103956.
- Limit mcp:write and a2a:write to a small set of trusted administrators and review who holds them.
- Ensure the container role follows least privilege; if credentials may have been exposed, rotate them and review CloudTrail.
- Check whether the Loom interface is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-124-AWS aws.amazon.com
- Loom v1.7.0 release notes github.com
- GitHub Security Advisory GHSA-w6g6-h8pv-6mc7 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:15.
Original description (NVD)
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.