{"id":"CVE-2026-107322","kind":"vulnerability","aliases":["CVE-2026-107322"],"related":[],"title":"Amazon Agent Plugins: databases-on-aws command injection via crafted agent content","description":"CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws\n\n### CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws\n\nBulletin ID: 2026-130-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 11:30 AM PDT\n\nDescription:\n\nAmazon Agent Plugins for AWS is an open source collection of plugins that extends supported AI coding agents with AWS-focused workflows and tool integrations. The databases-on-aws plugin provides database design, development, migration, and operational guidance, including Aurora DSQL helper scripts.\n\nWe identified CVE-2026-107322, where an incomplete list of disallowed inputs in databases-on-aws versions before 1.7.1 could allow a remote unauthenticated actor to supply crafted content that an agent ingests. The affected code is not a listening network service; operating-system command execution on the host is possible only if the agent subsequently invokes the local helper with the crafted database command value. Any resulting command runs with the permissions of the process running the helper. This issue does not affect the Aurora DSQL service or bypass database privileges.\n\nImpacted versions: databases-on-aws versions 1.0.0 through 1.7.0\n\nResolution:\n\nThe fix is included in databases-on-aws 1.7.1 and later and became available from the marketplace, which is served from the repository's main branch, on August 26, 2026. We recommend upgrading to the latest version, verifying that the updated plugin is active in every environment where it is used, and ensuring any forked or derivative code incorporates the fix. Customers using a pinned repository revision should use commit 8b13a503746a4ebb0402b936645163224058bde3 or later rather than relying on a 1.7.1 release tag.\n\nWorkarounds:\n\nCustomers who cannot immediately upgrade should avoid the optional psql connection helper command path and use only manually reviewed SQL, or use the DSQL MCP server provided through the plugin instead of the helper. Running the agent and helper as an unprivileged operating-system user with a dedicated AWS IAM role limited to dsql:DbConnect and a scoped database role, preferably read-only where appropriate, further limits the permissions available to the process. Do not use admin or grant dsql:DbConnectAdmin for routine agent operations. Customers who have reason to believe the helper host was inappropriately accessed should rotate or revoke the AWS credentials accessible to that process and review, revoke, or replace the database roles and IAM-to-database role mappings available to it. These measures reduce potential impact while an upgrade is scheduled; upgrading remains the recommended resolution.\n\nReferences:\n\n- CVE-2026-107322\n- GHSA-x7f2-wxc8-qpxq\n\nAcknowledgement:\n\nWe would like to thank Shay Sakazi (@shaysakazi) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The databases-on-aws plugin for Amazon Agent Plugins before 1.7.1 has an incomplete list of disallowed inputs, so crafted content an AI coding agent ingests can reach the psql connection helper's database command value. If the agent then invokes that helper, an attacker can run operating-system commands with the permissions of the helper process.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agents","ai-tooling","aurora-dsql","aws","databases-on-aws","developer-workstations","lab-disclosure"],"not_affected_if":["dsql-mcp-server-only","helper-not-used","plugin-version-1.7.1-or-later"],"how_to_check":"- Check the installed databases-on-aws plugin version; affected versions are `1.0.0` through `1.7.0`.\n- Confirm whether the agent is pinned to a repository revision; the fix is commit `8b13a503746a4ebb0402b936645163224058bde3` or later.\n- Confirm whether the optional psql connection helper is in use by the agent.","fix":"- Upgrade databases-on-aws to `1.7.1` or later, or to commit `8b13a503746a4ebb0402b936645163224058bde3` or later if pinned to a repository revision.\n- Verify the updated plugin is active in every environment where it is used, including forks or derivative code.\n- Until upgraded, avoid the optional psql connection helper and use manually reviewed SQL or the DSQL MCP server instead.\n- Run the agent as an unprivileged OS user with a dedicated IAM role limited to `dsql:DbConnect` and a scoped read-only database role; do not grant `dsql:DbConnectAdmin`.","status":"open","published_at":"2026-10-08T19:16:59+00:00","first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T03:01:37+00:00","updated_at":"2026-10-25T03:01:37+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:01:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade databases-on-aws to `1.7.1` or later, or to commit `8b13a503746a4ebb0402b936645163224058bde3` or later if pinned to a repository revision.\n- Verify the updated plugin is active in every environment where it is used, including forks or derivative code.\n- Until upgraded, avoid the optional psql connection helper and use manually reviewed SQL or the DSQL MCP server instead.\n- Run the agent as an unprivileged OS user with a dedicated IAM role limited to `dsql:DbConnect` and a scoped read-only database role; do not grant `dsql:DbConnectAdmin`.","reach":"network","title":"Amazon Agent Plugins: databases-on-aws command injection via crafted agent content","impact":"high","summary":"The databases-on-aws plugin for Amazon Agent Plugins before 1.7.1 has an incomplete list of disallowed inputs, so crafted content an AI coding agent ingests can reach the psql connection helper's database command value. If the agent then invokes that helper, an attacker can run operating-system commands with the permissions of the helper process.","category":"ai-tooling","nicknames":[],"who_cares":["aws","ai-coding-agents","databases-on-aws","aurora-dsql","developer-workstations"],"confidence":0.7,"needs_auth":"no","worst_case":"OS commands run as the helper process user, exposing credentials and data","analyst_note":"Check the GHSA-x7f2-wxc8-qpxq advisory and the AWS bulletin 2026-130-AWS for exact affected commit ranges and whether the psql helper is enabled by default.","how_to_check":"- Check the installed databases-on-aws plugin version; affected versions are `1.0.0` through `1.7.0`.\n- Confirm whether the agent is pinned to a repository revision; the fix is commit `8b13a503746a4ebb0402b936645163224058bde3` or later.\n- Confirm whether the optional psql connection helper is in use by the agent.","needs_analyst":true,"not_affected_if":["plugin-version-1.7.1-or-later","helper-not-used","dsql-mcp-server-only"],"who_is_affected":"Teams running the databases-on-aws plugin from Amazon Agent Plugins for AWS with an AI coding agent, where the agent can invoke the local psql helper on a host holding AWS credentials or database access. The Aurora DSQL service itself and database privileges are not bypassed according to the bulletin. Teams that do not use this plugin, or that use the DSQL MCP server instead of the helper, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000902,"input_tokens":4353,"output_tokens":933,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107322':16A,19A,102C,118C,201C,531C '-130':135C '-2026':15A,18A,101C,117C,200C,530C '1.0.0':298C '1.7.0':300C '1.7.1':52B,216C,311C,381C '10/08/2026':146C '11':147C '2026':134C,332C '26':331C '30':148C '8b13a503746a4ebb0402b936645163224058bde3':373C 'access':483C,491C 'acknowledg':537C 'activ':346C 'actor':222C 'admin':463C 'affect':232C,282C 'agent':2A,12A,23B,49B,66B,80B,108C,124C,153C,169C,229C,253C,421C,470C 'ai':21B,25B,64B,167C 'ai-coding-ag':20B 'ai-tool':24B 'allow':218C 'amazon':1A,48B,107C,123C,152C 'appropri':451C 'attack':86B 'attent':143C 'august':330C 'aurora':28B,193C,284C 'aurora-dsql':27B 'avail':316C,456C,510C 'avoid':391C 'aw':7A,30B,34B,45B,111C,115C,127C,131C,136C,138C,156C,172C,182C,213C,296C,310C,434C,489C 'aws-focus':171C 'aws-security@amazon.com':559C 'becam':315C 'believ':477C 'branch':328C 'bulletin':132C 'bypass':288C 'cannot':387C 'code':22B,65B,168C,233C,360C 'collabor':547C 'collect':161C 'command':8A,76B,92B,104C,120C,243C,263C,267C,397C 'commit':372C 'concern':565C 'connect':72B,395C 'content':13A,62B,139C,226C 'coordin':553C 'could':217C 'craft':11A,61B,225C,261C 'credenti':490C 'custom':364C,385C,472C 'cve':14A,17A,100C,116C,199C,529C 'databas':5A,32B,43B,75B,113C,129C,180C,185C,211C,262C,289C,294C,308C,444C,501C,507C 'databases-on-aw':4A,31B,42B,112C,128C,179C,210C,293C,307C 'date':145C 'dbconnect':440C 'dbconnectadmin':467C 'dedic':433C 'deriv':359C 'descript':151C 'design':186C 'develop':36B,187C 'developer-workst':35B 'disallow':58B,207C 'disclosur':40B,555C 'dsql':29B,194C,285C,408C,439C,466C 'email':558C 'ensur':355C 'environ':349C 'everi':348C 'execut':244C 'extend':165C 'fix':303C,363C 'focus':173C 'fork':357C 'ghsa':533C 'ghsa-x7f2-wxc8-qpxq':532C 'grant':465C 'guidanc':191C 'helper':73B,84B,98B,195C,258C,277C,396C,418C,423C,479C 'host':247C,480C 'iam':435C,505C 'iam-to-databas':504C 'id':133C 'identifi':198C 'immedi':388C 'impact':291C,517C 'import':141C 'inappropri':482C 'includ':192C,305C 'incomplet':55B,204C 'incorpor':361C 'ingest':67B,230C 'inject':9A,105C,121C 'input':59B,208C 'instead':415C 'integr':177C 'invok':82B,255C 'issu':279C,550C 'lab':39B 'lab-disclosur':38B 'later':313C,375C 'latest':338C 'like':540C 'limit':437C,453C 'list':56B,205C 'listen':237C 'local':257C 'main':327C 'manual':402C 'map':509C 'marketplac':319C 'mcp':409C 'measur':514C 'migrat':188C 'network':238C 'open':159C 'oper':90B,190C,241C,428C,471C 'operating-system':89B,240C,427C 'option':393C 'os':103C,119C 'path':398C 'pdt':150C 'permiss':95B,271C,455C 'pin':367C 'pleas':557C 'plugin':3A,46B,50B,109C,125C,154C,163C,183C,344C,414C 'possibl':249C 'potenti':516C 'prefer':446C 'privileg':290C 'process':99B,274C,459C,494C,556C 'provid':184C,411C 'psql':71B,394C 'public':144C 'qpxq':536C 'question':563C 'rather':376C 'reach':69B 'read':448C 'read-on':447C 'reason':475C 'recommend':334C,526C 'reduc':515C 'refer':528C 'releas':382C 'reli':378C 'remain':524C 'remot':220C 'replac':499C 'repositori':325C,368C 'requir':142C 'resolut':301C,527C 'result':266C 'review':403C,496C 'revis':369C 'revok':487C,497C 'role':436C,445C,502C,508C 'rotat':485C 'routin':469C 'run':88B,268C,275C,419C 'sakazi':544C 'schedul':522C 'scope':137C,443C 'script':196C 'secur':562C 'serv':322C 'server':410C 'servic':239C,286C 'shay':543C 'shaysakazi':545C 'sourc':160C 'sql':404C 'subsequ':254C 'suppli':224C 'support':166C 'system':91B,242C,429C 'tag':383C 'thank':542C 'tool':26B,176C 'type':140C 'unauthent':221C 'unprivileg':426C 'updat':343C 'upgrad':335C,389C,520C,523C 'use':353C,365C,371C,400C,406C,462C 'user':430C 'valu':77B,264C 'verifi':340C 'version':214C,292C,297C,339C 'via':10A 'vulner':554C 'workaround':384C 'workflow':174C 'workstat':37B 'would':539C 'wxc8':535C 'x7f2':534C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"databases-on-aws plugin: optional psql connection helper command path","since":null,"covers":"The databases-on-aws plugin's optional psql connection helper command path, avoided by using only manually reviewed SQL or the DSQL MCP server provided through the plugin instead of the helper.","limits":"Does not remove or fix the vulnerable code; the helper stays installed and any use of it remains exposed until the plugin is upgraded to 1.7.1 or later.","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/","vendor":"Team","seen_at":"2026-10-25T01:11:08Z","sources":["https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/"],"confidence":0.9,"source_title":"CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws","customer_action":"Stop using the psql connection helper command path; run only manually reviewed SQL or use the DSQL MCP server, and upgrade databases-on-aws to 1.7.1 or later when scheduled."},{"kind":"workaround","scope":"Agent and databases-on-aws helper process: operating-system and AWS/database permissions","since":null,"covers":"Limits the permissions available to the process if the helper is invoked with a crafted command: runs as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped, preferably read-only database role","limits":"Reduces impact only; command execution on the host is still possible and the flaw is not fixed","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/","vendor":"Team","seen_at":"2026-10-24T21:06:12Z","confidence":0.85,"source_title":"CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws","customer_action":"Run the agent and helper as an unprivileged OS user, grant only dsql:DbConnect with a scoped database role (preferably read-only), do not grant dsql:DbConnectAdmin for routine use, and rotate or revoke credentials and database role mappings if the helper host may have been inappropriately accessed"},{"kind":"workaround","scope":"databases-on-aws plugin helper process, agent runtime and AWS/database access","since":null,"covers":"Limits the permissions available to the agent and helper process if the helper is invoked.","limits":"Reduces impact only; any command the helper runs still executes with the process's permissions, and the flaw is not fixed.","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/","vendor":"Team","seen_at":"2026-10-25T01:11:08Z","confidence":0.85,"source_title":"CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws","customer_action":"Run the agent and helper as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped, preferably read-only database role; do not use admin or grant dsql:DbConnectAdmin for routine operations."}],"who_affected":"Teams running the databases-on-aws plugin from Amazon Agent Plugins for AWS with an AI coding agent, where the agent can invoke the local psql helper on a host holding AWS credentials or database access. The Aurora DSQL service itself and database privileges are not bypassed according to the bulletin. Teams that do not use this plugin, or that use the DSQL MCP server instead of the helper, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/#CVE-2026-107322","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-25T01:12:28+00:00","note":"AWS: CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws"},{"source":"nvd","external_id":"CVE-2026-107322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107322","severity":null,"published_at":"2026-10-08T19:16:59+00:00","modified_at":"2026-10-08T20:17:31+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null}],"documents":[{"id":2944,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/","title":"AWS: CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws","kind":"advisory","source":"lab","text":"CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws\n\n### CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws\n\nBulletin ID: 2026-130-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 11:30 AM PDT\n\nDescription:\n\nAmazon Agent Plugins for AWS is an open source collection of plugins that extends supported AI coding agents with AWS-focused workflows and tool integrations. The databases-on-aws plugin provides database design, development, migration, and operational guidance, including Aurora DSQL helper scripts.\n\nWe identified CVE-2026-107322, where an incomplete list of disallowed inputs in databases-on-aws versions before 1.7.1 could allow a remote unauthenticated actor to supply crafted content that an agent ingests. The affected code is not a listening network service; operating-system command execution on the host is possible only if the agent subsequently invokes the local helper with the crafted database command value. Any resulting command runs with the permissions of the process running the helper. This issue does not affect the Aurora DSQL service or bypass database privileges.\n\nImpacted versions: databases-on-aws versions 1.0.0 through 1.7.0\n\nResolution:\n\nThe fix is included in databases-on-aws 1.7.1 and later and became available from the marketplace, which is served from the repository's main branch, on August 26, 2026. We recommend upgrading to the latest version, verifying that the updated plugin is active in every environment where it is used, and ensuring any forked or derivative code incorporates the fix. Customers using a pinned repository revision should use commit 8b13a503746a4ebb0402b936645163224058bde3 or later rather than relying on a 1.7.1 release tag.\n\nWorkarounds:\n\nCustomers who cannot immediately upgrade should avoid the optional psql connection helper command path and use only manually reviewed SQL, or use the DSQL MCP server provided through the plugin instead of the helper. Running the agent and helper as an unprivileged operating-system user with a dedicated AWS IAM role limited to dsql:DbConnect and a scoped database role, preferably read-only where appropriate, further limits the permissions available to the process. Do not use admin or grant dsql:DbConnectAdmin for routine agent operations. Customers who have reason to believe the helper host was inappropriately accessed should rotate or revoke the AWS credentials accessible to that process and review, revoke, or replace the database roles and IAM-to-database role mappings available to it. These measures reduce potential impact while an upgrade is scheduled; upgrading remains the recommended resolution.\n\nReferences:\n\n- CVE-2026-107322\n- GHSA-x7f2-wxc8-qpxq\n\nAcknowledgement:\n\nWe would like to thank Shay Sakazi (@shaysakazi) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}