Threat database

CVE-2026-103958 is a server-side request forgery (SSRF) vulnerability in AWS Loom versions before 1.7.0. It affects the tool server and remote agent connection handling, allowing an authenticated remote user to potentially obtain the application's container role credentials and read responses from arbitrary internal network locations. The vulnerability is fixed in version 1.7.0 and later.

CVE-2026-103957 is a server-side request forgery (SSRF) vulnerability in AWS Loom versions before 1.7.0. It affects the OAuth2 discovery handling, allowing an authenticated remote user to obtain another user's access token and make the application send requests to arbitrary internal network locations. The issue is fixed in version 1.7.0 and later.

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

CVE-2024-23742 is a vulnerability in Loom on macOS versions 0.196.1 and earlier that could allow remote attackers to execute arbitrary code via specific settings. However, the vendor disputes the remote attack vector, stating that local access to the victim's machine is required for exploitation.