Threats affecting pkg:pypi/moto

CVE-2026-124501 is a medium severity vulnerability in Tidelift moto up to version 5.2.4 involving improper privilege management in the AWS Batch Emulation component. The flaw arises from manipulation of the privileged/volumes argument in the moto/batch/models.py file. Remote exploitation is possible, and public exploit code is available. The vendor has not responded to the disclosure. A patch is available, and the service is cloud-hosted, so vendor-managed remediation is expected.