// AWSHIGH
AWS released security patches for four vulnerabilities affecting Loom AI agent orchestration platform and Amazon SageMaker Unified Studio, disclosed on October 2, 2026. The flaws include missing authentication (CVE-2026-103956), OAuth2 token disclosure (CVE-2026-103957), internal network access via SSRF (CVE-2026-103958), and OS command injection in SageMaker startup scripts (CVE-2026-104019). Attackers could bypass authentication, steal credentials and OAuth2 tokens, access internal services, and execute arbitrary code. AWS recommends immediate upgrades to Loom 1.7.0 and restarting affected SageMaker Studio Spaces.
- AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication(opens in a new tab)
- AWS AI Agent Vulnerabilities Let Attackers Bypass Authentication(opens in a new tab)
- AWS Fixes AI Agent Flaws Enabling Authentication Bypass and Cred(opens in a new tab)
// Get alerts for AWS