CVE-2026-103956
Received Received - Intake

Authentication Bypass in Loom for AWS

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: AMZN

Description
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-03
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-103956
EUVD
EUVD-2026-91770

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
aws loom 1.6.1
aws loom 1.7.0
loom loom 1.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Loom for AWS before version 1.6.1. It allows remote attackers to gain super-admin access to the agent control plane without authentication. This includes registering tool servers, reading stored integration credentials, and modifying IAM role policies attached to managed agent roles. The issue occurs when no identity provider is configured in the deployment.

Detection Guidance

Detect this vulnerability by checking if your Loom deployment is running a version before 1.6.1. Use commands like 'loom version' or inspect deployment logs for version information. Verify if the application API allows unauthenticated requests when no identity provider is configured.

Impact Analysis

An attacker could exploit this to take full control of the Loom system, access sensitive data like integration credentials, and alter IAM policies. This could lead to unauthorized access to cloud resources, data breaches, or further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. It undermines access controls and auditability, increasing legal and financial risks.

Mitigation Strategies

Upgrade Loom to version 1.6.1 or later immediately. Set the LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV environment variable to false or remove it to enforce authentication. Review API access logs for suspicious activity and ensure no identity provider is misconfigured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart