CVE-2026-105811: CWE-639 Authorization bypass through User-Controlled key in aws qnabot-on-aws

This vulnerability (CVE-2026-105811) involves an authorization bypass caused by a user-controlled key in the optional Amazon Q Business Lambda hook sample for QnABot on AWS. The affected versions are from 7.0.0 up to but not including 7.4.6. Exploitation could allow an authenticated remote user to read arbitrary S3 objects in the AWS account where the vulnerable Lambda hook is deployed. The vulnerability arises because the Lambda hook sample does not properly restrict access based on the user-controlled key. The sample requires separate manual deployment and additional setup, so only customers who have deployed this optional component are affected. Remediation requires updating QnABot on AWS to version 7.4.6 or later and redeploying the Lambda hook sample stack, as updating QnABot alone does not fix the issue.

An authenticated remote user could bypass authorization controls in the optional Lambda hook and read arbitrary Amazon S3 objects in the AWS account. This could lead to unauthorized data disclosure of sensitive information stored in S3 buckets accessible by the Lambda hook. The impact is limited to environments where the optional Lambda hook sample has been deployed.

A patch is available in QnABot on AWS version 7.4.6 and later. Affected customers should update to version 7.4.6 or newer and redeploy the Amazon Q Business Lambda hook sample stack to fully remediate the vulnerability. Customers who have not deployed this optional Lambda hook sample are not affected and do not need to take any action.