CVE-2026-103956: CWE-306 Missing authentication for critical function in AWS loom
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.
AI Analysis
Technical Summary
AWS Loom, an open-source AI agent orchestration platform, had an authentication bypass vulnerability (CWE-306, CWE-1188) in versions before 1.6.1. When no identity provider was configured, any network client could bypass authentication and obtain full administrative privileges over the agent control plane. This allowed unauthorized registration of tool servers, reading of integration credentials, and rewriting of IAM role policies attached to managed agent roles. The vulnerability was addressed in Loom version 1.6.1 released on 2026-08-04. Additional related vulnerabilities affecting OAuth2 token disclosure and outbound request handling were fixed in version 1.7.0.
Potential Impact
An unauthenticated attacker on the network can gain full administrative authority over the Loom agent control plane, potentially leading to unauthorized access to sensitive credentials and modification of IAM role policies. This can result in complete compromise of the affected AWS Loom deployment's agent orchestration capabilities and associated AWS resources.
Mitigation Recommendations
AWS has released version 1.6.1 of Loom which fixes this authentication bypass vulnerability. Users should upgrade to at least version 1.6.1 to remediate CVE-2026-103956. AWS further recommends upgrading to version 1.7.0 to address additional related vulnerabilities. Since Loom is an open-source platform, ensure any forked or derivative codebases are also patched accordingly. For this cloud-hosted service, AWS manages remediation for the underlying infrastructure. Refer to the official AWS Security Bulletin at https://aws.amazon.com/security/security-bulletins/2026-124-aws/ for the latest guidance.
CVE-2026-103956: CWE-306 Missing authentication for critical function in AWS loom
Description
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.
CVSS v3.1
Score 10.0critical
Affected software
AWS
loom
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AWS Loom, an open-source AI agent orchestration platform, had an authentication bypass vulnerability (CWE-306, CWE-1188) in versions before 1.6.1. When no identity provider was configured, any network client could bypass authentication and obtain full administrative privileges over the agent control plane. This allowed unauthorized registration of tool servers, reading of integration credentials, and rewriting of IAM role policies attached to managed agent roles. The vulnerability was addressed in Loom version 1.6.1 released on 2026-08-04. Additional related vulnerabilities affecting OAuth2 token disclosure and outbound request handling were fixed in version 1.7.0.
Potential Impact
An unauthenticated attacker on the network can gain full administrative authority over the Loom agent control plane, potentially leading to unauthorized access to sensitive credentials and modification of IAM role policies. This can result in complete compromise of the affected AWS Loom deployment's agent orchestration capabilities and associated AWS resources.
Mitigation Recommendations
AWS has released version 1.6.1 of Loom which fixes this authentication bypass vulnerability. Users should upgrade to at least version 1.6.1 to remediate CVE-2026-103956. AWS further recommends upgrading to version 1.7.0 to address additional related vulnerabilities. Since Loom is an open-source platform, ensure any forked or derivative codebases are also patched accordingly. For this cloud-hosted service, AWS manages remediation for the underlying infrastructure. Refer to the official AWS Security Bulletin at https://aws.amazon.com/security/security-bulletins/2026-124-aws/ for the latest guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-10-01T14:59:36.204Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-124-aws/","vendor":"AWS"}]
Threat ID: 6ac00321a43b0b3b89f06a30
Added to database: 10/02/2026, 19:16:49 UTC
Last enriched: 10/02/2026, 19:30:06 UTC
Last updated: 10/03/2026, 02:44:56 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.