{"id":"CVE-2026-103958","kind":"vulnerability","aliases":["CVE-2026-103958"],"related":[],"title":"Loom for AWS: authenticated users can reach internal addresses via tool server connections","description":"CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS\n\n### CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS\n\nBulletin ID: 2026-124-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 12:00 PM PDT\n\nDescription:\n\nLoom is an AWS Labs open-source AI agent orchestration platform. We have identified and addressed three issues in Loom for AWS, described below. We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n- CVE-2026-103956 — Authentication bypass in Loom for AWS (CWE-306, CWE-1188) An issue in the authentication dependency in Loom for AWS versions <1.6.1 allowed any network client to obtain full administrative authority over the agent control plane — including registering tool servers, reading stored integration credentials, and rewriting IAM role policies attached to managed agent roles — via any request to the application API in a deployment where no identity provider was configured. This issue was addressed in version 1.6.1, released 2026-08-04.\n- CVE-2026-103957 — OAuth2 token and credential disclosure via outbound request handling in Loom for AWS (CWE-918, CWE-201) An issue in the OAuth2 discovery handling in Loom for AWS versions <1.7.0 allowed an authenticated user with the mcp:write or a2a:write scope to configure a well-known discovery URL whose document directed the backend to send OAuth2 client secrets or another user's access token to a third-party-controlled endpoint. The 1.6.1 release blocked internal-address reach for this code path but did not fully address the token disclosure. This issue was fully addressed in version 1.7.0.\n- CVE-2026-103958 — Outbound request handling issue in tool server and remote agent connections in Loom for AWS (CWE-918) An issue in the tool server (MCP) and remote agent (A2A) connection handling in Loom for AWS versions <1.7.0 allowed an authenticated user with the mcp:write or a2a:write scope to direct connection requests to arbitrary internal network locations — including the container's credential-vending endpoint — and read the responses. This issue was addressed in version 1.7.0.\n\nResolution:\n\nThese issues have been addressed in Loom version 1.7.0. CVE-2026-103956 was independently addressed in version 1.6.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nUntil upgrading:\n\n- For CVE-2026-103956: Ensure a Cognito user pool or an active external identity provider is fully configured before the backend is reachable beyond loopback, and confirm LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset in any deployed (non-local-dev) environment.\n- For CVE-2026-103957 and CVE-2026-103958: Restrict the mcp:write, and a2a:write scopes (i.e., g-admins-super, g-admins-mcp, g-admins-a2a, g-admins-demo group membership) to trusted administrators only. This reduces the likelihood of these issues being triggered but does not fully close the issue without the code fix.\n\nAfter upgrading:\n\n1. Rotate any OAuth2 client secrets configured for MCP/A2A integrations\n2. Revoke and re-issue any access tokens that were active during the affected window\n3. If container role credentials were accessed, rotate the IAM role's session credentials and review CloudTrail for unintended usage.\n\nReferences:\n\n- CVE-2026-103956\n- CVE-2026-103957\n- CVE-2026-103958\n- GHSA-vgmj-998f-r8mp\n- GHSA-jcxf-gpf4-58hm\n- GHSA-w6g6-h8pv-6mc7\n\nAcknowledgement:\n\nWe would like to thank Kenneth Cox for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Loom for AWS, an AWS Labs AI agent orchestration platform, let a user with the mcp:write or a2a:write scope direct connection requests to arbitrary internal network locations, including the container's credential-vending endpoint, and read the responses. An attacker with that scope can read internal responses and potentially obtain container role credentials.","severity":"high","cvss":8.3,"epss":0.00331,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","ai-tooling","aws","lab-disclosure","loom","mcp","self-hosted"],"not_affected_if":["no-mcp-or-a2a-write-users","version-1.7.0-or-later"],"how_to_check":"- Check the deployed Loom version; affected versions are those before `1.7.0`.\n- Check whether any user or group holds mcp:write or a2a:write (for example g-admins-super, g-admins-mcp, g-admins-a2a, g-admins-demo).\n- Check CloudTrail for unexpected use of the container role's session credentials if the instance was reachable this way.","fix":"- Upgrade Loom for AWS to `1.7.0` and patch any forked or derivative code with the same fixes.\n- Until upgraded, restrict mcp:write and a2a:write to trusted administrators only.\n- After upgrading, rotate OAuth2 client secrets for MCP/A2A integrations, revoke and re-issue tokens active during the affected window, and rotate IAM role session credentials if container role credentials were accessed.","status":"open","published_at":"2026-10-02T19:16:40+00:00","first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T03:02:37+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:02:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Loom for AWS to `1.7.0` and patch any forked or derivative code with the same fixes.\n- Until upgraded, restrict mcp:write and a2a:write to trusted administrators only.\n- After upgrading, rotate OAuth2 client secrets for MCP/A2A integrations, revoke and re-issue tokens active during the affected window, and rotate IAM role session credentials if container role credentials were accessed.","reach":"network","title":"Loom for AWS: authenticated users can reach internal addresses via tool server connections","impact":"high","summary":"Loom for AWS, an AWS Labs AI agent orchestration platform, let a user with the mcp:write or a2a:write scope direct connection requests to arbitrary internal network locations, including the container's credential-vending endpoint, and read the responses. An attacker with that scope can read internal responses and potentially obtain container role credentials.","category":"ai-tooling","nicknames":[],"who_cares":["aws","loom","mcp","a2a","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads container role credentials and internal responses via connection requests","analyst_note":"","how_to_check":"- Check the deployed Loom version; affected versions are those before `1.7.0`.\n- Check whether any user or group holds mcp:write or a2a:write (for example g-admins-super, g-admins-mcp, g-admins-a2a, g-admins-demo).\n- Check CloudTrail for unexpected use of the container role's session credentials if the instance was reachable this way.","needs_analyst":false,"not_affected_if":["version-1.7.0-or-later","no-mcp-or-a2a-write-users"],"who_is_affected":"Teams running Loom for AWS before `1.7.0` where users hold the mcp:write or a2a:write scope, since that is what lets a request reach the tool server and remote agent connection code. Deployments that restrict those scopes to trusted administrators reduce the risk but do not close it without the code fix. Teams not running Loom can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000847,"input_tokens":4734,"output_tokens":747,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-04':269C '-08':268C '-103956':91C,106C,188C,465C,498C,647C '-103957':94C,109C,272C,540C,650C '-103958':16A,19A,98C,113C,376C,544C,653C '-1188':198C '-124':122C '-201':289C '-2026':15A,18A,90C,93C,97C,105C,108C,112C,187C,271C,375C,464C,497C,539C,543C,646C,649C,652C '-306':196C '-918':287C,393C '00':135C '1':598C '1.6.1':210C,265C,347C,471C '1.7.0':171C,302C,373C,412C,452C,462C '10/02/2026':133C '12':134C '2':608C '2026':121C,267C '3':624C '58hm':663C '6mc7':668C '998f':657C 'a2a':20B,51B,312C,404C,422C,550C,565C 'access':337C,615C,630C 'acknowledg':669C 'activ':506C,619C 'address':9A,155C,262C,352C,362C,370C,449C,458C,468C 'admin':556C,560C,564C,568C 'administr':218C,574C 'affect':622C 'agent':40B,148C,222C,241C,386C,403C 'ai':22B,39B,147C 'ai-tool':21B 'allow':211C,303C,413C,523C 'anoth':334C 'api':249C 'applic':248C 'arbitrari':58B,430C 'attach':238C 'attack':75B 'attent':130C 'authent':4A,189C,203C,305C,415C 'author':219C 'aw':3A,24B,35B,37B,103C,118C,123C,125C,142C,161C,194C,208C,285C,300C,391C,410C 'aws-security@amazon.com':689C 'backend':327C,515C 'beyond':518C 'block':349C 'bulletin':119C 'bypass':190C 'client':214C,331C,602C 'close':589C 'cloudtrail':640C 'code':178C,356C,485C,594C 'cognito':501C 'collabor':678C 'concern':695C 'configur':258C,316C,512C,604C 'confirm':521C 'connect':13A,55B,387C,405C,427C 'contain':64B,86B,436C,626C 'content':126C 'control':223C,344C 'coordin':684C 'cox':676C 'credenti':67B,88B,232C,276C,439C,628C,637C 'credential-vend':66B,438C 'cve':14A,17A,89C,92C,96C,104C,107C,111C,186C,270C,374C,463C,496C,538C,542C,645C,648C,651C 'cwe':195C,197C,286C,288C,392C 'date':132C 'demo':569C 'depend':204C 'deploy':252C,531C 'deriv':177C,484C 'describ':162C 'descript':138C 'dev':526C,535C 'direct':54B,325C,426C 'disclosur':27B,277C,365C,685C 'discoveri':295C,321C 'document':324C 'email':688C 'endpoint':69B,345C,441C 'ensur':173C,480C,499C 'environ':536C 'extern':507C 'fix':185C,492C,595C 'fork':175C,482C 'full':217C 'fulli':361C,369C,511C,588C 'g':555C,559C,563C,567C 'g-admins-a2a':562C 'g-admins-demo':566C 'g-admins-mcp':558C 'g-admins-sup':554C 'ghsa':655C,660C,665C 'ghsa-jcxf-gpf4-58hm':659C 'ghsa-vgmj-998f-r8mp':654C 'ghsa-w6g6-h8pv-6mc7':664C 'gpf4':662C 'group':570C 'h8pv':667C 'handl':281C,296C,379C,406C 'host':32B 'i.e':553C 'iam':235C,633C 'id':120C 'ident':255C,508C 'identifi':153C 'import':128C 'includ':62B,225C,434C 'incorpor':182C,489C 'independ':467C 'integr':231C,607C 'intern':8A,59B,81B,351C,431C 'internal-address':350C 'issu':99C,114C,157C,200C,260C,291C,367C,380C,395C,447C,455C,582C,591C,613C,681C 'jcxf':661C 'kenneth':675C 'known':320C 'lab':26B,38B,143C 'lab-disclosur':25B 'latest':169C,477C 'let':43B 'like':672C 'likelihood':579C 'local':525C,534C 'locat':61B,433C 'loom':1A,28B,33B,101C,116C,139C,159C,192C,206C,283C,298C,389C,408C,460C,522C 'loopback':519C 'manag':240C 'mcp':29B,48B,309C,400C,419C,547C,561C 'mcp/a2a':606C 'membership':571C 'network':60B,213C,432C 'new':184C,491C 'non':533C 'non-local-dev':532C 'oauth2':273C,294C,330C,601C 'obtain':85B,216C 'open':145C 'open-sourc':144C 'orchestr':41B,149C 'outbound':279C,377C 'parti':343C 'patch':180C,487C 'path':357C 'pdt':137C 'plane':224C 'platform':42B,150C 'pleas':687C 'pm':136C 'polici':237C 'pool':503C 'potenti':84B 'process':686C 'provid':256C,509C 'public':131C 'question':693C 'r8mp':658C 're':612C 're-issu':611C 'reach':7A,353C 'reachabl':517C 'read':71B,80B,229C,443C 'recommend':165C,473C 'reduc':577C 'refer':644C 'regist':226C 'releas':266C,348C 'remot':385C,402C 'request':56B,245C,280C,378C,428C 'requir':129C 'resolut':453C 'respons':73B,82B,445C 'restrict':545C 'review':639C 'revok':609C 'rewrit':234C 'role':87B,236C,242C,627C,634C 'rotat':599C,631C 'scope':53B,78B,124C,314C,424C,552C 'secret':332C,603C 'secur':692C 'self':31B 'self-host':30B 'send':329C 'server':12A,228C,383C,399C 'session':636C 'sourc':146C 'store':230C 'super':557C 'thank':674C 'third':342C 'third-party-control':341C 'three':156C 'token':274C,338C,364C,616C 'tool':11A,23B,227C,382C,398C 'trigger':584C 'trust':573C 'type':127C 'unauthent':524C 'unintend':642C 'unset':528C 'upgrad':166C,474C,494C,597C 'url':322C 'usag':643C 'user':5A,45B,306C,335C,416C,502C 'vend':68B,440C 'version':170C,209C,264C,301C,372C,411C,451C,461C,470C,478C 'vgmj':656C 'via':10A,243C,278C 'w6g6':666C 'well':319C 'well-known':318C 'whose':323C 'window':623C 'without':592C 'would':671C 'write':49B,52B,310C,313C,420C,423C,548C,551C","nicknames":[],"mitigations":[],"who_affected":"Teams running Loom for AWS before `1.7.0` where users hold the mcp:write or a2a:write scope, since that is what lets a request reach the tool server and remote agent connection code. Deployments that restrict those scopes to trusted administrators reduce the risk but do not close it without the code fix. Teams not running Loom can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-02T19:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-124-aws/#CVE-2026-103958","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-124-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-25T08:14:50+00:00","note":"AWS: CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS"},{"source":"nvd","external_id":"CVE-2026-103958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103958","severity":null,"published_at":"2026-10-02T19:16:40+00:00","modified_at":"2026-10-06T18:16:42+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-103958","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103958","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2947,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-124-aws/","title":"AWS: CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS","kind":"advisory","source":"lab","text":"CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS\n\n### CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS\n\nBulletin ID: 2026-124-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 12:00 PM PDT\n\nDescription:\n\nLoom is an AWS Labs open-source AI agent orchestration platform. We have identified and addressed three issues in Loom for AWS, described below. We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n- CVE-2026-103956 — Authentication bypass in Loom for AWS (CWE-306, CWE-1188) An issue in the authentication dependency in Loom for AWS versions <1.6.1 allowed any network client to obtain full administrative authority over the agent control plane — including registering tool servers, reading stored integration credentials, and rewriting IAM role policies attached to managed agent roles — via any request to the application API in a deployment where no identity provider was configured. This issue was addressed in version 1.6.1, released 2026-08-04.\n- CVE-2026-103957 — OAuth2 token and credential disclosure via outbound request handling in Loom for AWS (CWE-918, CWE-201) An issue in the OAuth2 discovery handling in Loom for AWS versions <1.7.0 allowed an authenticated user with the mcp:write or a2a:write scope to configure a well-known discovery URL whose document directed the backend to send OAuth2 client secrets or another user's access token to a third-party-controlled endpoint. The 1.6.1 release blocked internal-address reach for this code path but did not fully address the token disclosure. This issue was fully addressed in version 1.7.0.\n- CVE-2026-103958 — Outbound request handling issue in tool server and remote agent connections in Loom for AWS (CWE-918) An issue in the tool server (MCP) and remote agent (A2A) connection handling in Loom for AWS versions <1.7.0 allowed an authenticated user with the mcp:write or a2a:write scope to direct connection requests to arbitrary internal network locations — including the container's credential-vending endpoint — and read the responses. This issue was addressed in version 1.7.0.\n\nResolution:\n\nThese issues have been addressed in Loom version 1.7.0. CVE-2026-103956 was independently addressed in version 1.6.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nUntil upgrading:\n\n- For CVE-2026-103956: Ensure a Cognito user pool or an active external identity provider is fully configured before the backend is reachable beyond loopback, and confirm LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset in any deployed (non-local-dev) environment.\n- For CVE-2026-103957 and CVE-2026-103958: Restrict the mcp:write, and a2a:write scopes (i.e., g-admins-super, g-admins-mcp, g-admins-a2a, g-admins-demo group membership) to trusted administrators only. This reduces the likelihood of these issues being triggered but does not fully close the issue without the code fix.\n\nAfter upgrading:\n\n1. Rotate any OAuth2 client secrets configured for MCP/A2A integrations\n2. Revoke and re-issue any access tokens that were active during the affected window\n3. If container role credentials were accessed, rotate the IAM role's session credentials and review CloudTrail for unintended usage.\n\nReferences:\n\n- CVE-2026-103956\n- CVE-2026-103957\n- CVE-2026-103958\n- GHSA-vgmj-998f-r8mp\n- GHSA-jcxf-gpf4-58hm\n- GHSA-w6g6-h8pv-6mc7\n\nAcknowledgement:\n\nWe would like to thank Kenneth Cox for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}