{"id":"CVE-2026-122193","kind":"vulnerability","aliases":["CVE-2026-122193"],"related":[],"title":"AWS Trusted Remote Execution: SSM setup script lets users run commands as root","description":"CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\n### CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\nBulletin ID: 2026-173-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 09:00 AM PST\n\n Description:\n\nTrusted Remote Execution (REX) is an open-source framework for executing sandboxed scripts on managed instances, where a signed Cedar policy is meant to be the immutable security boundary around each script run.\n\nWe identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS Systems Manager (SSM) documents (Rex-RO and Rex-RW) for running scripts on managed instances. Due to how the example script handled input parameters, a user with permissions to invoke the SSM document could supply crafted input that would run unintended operating system commands on the managed instance, outside of the REX sandbox. The scriptArgs parameter is affected by the same class of issue.\n\nImpacted versions: \n\nThis is not an issue in a shipped REX artifact version. It is an affected example in the set-up documentation. Anyone who created the Rex-RO / Rex-RW SSM documents by following the guide is affected.\n\nResolution:\n\nWe removed this set-up example from the guide. We recommend you delete any SSM documents if you created them, in each account/region where you ran the example:\n\n- Deleting custom SSM documents\n- delete-document\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-122193\n- GHSA-95g5-m242-wvhr\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The example SSM document provisioning script in AWS Trusted Remote Execution (REX) before 2026-07-28 has an OS command injection flaw. An authenticated user allowed to invoke the Rex-RO or Rex-RW SSM document can run arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","cedar","infrastructure","lab-disclosure","managed-instances","ssm","trusted-remote-execution"],"not_affected_if":["never-ran-example-script"],"how_to_check":"- Look for Rex-RO and Rex-RW SSM documents in each AWS account and Region where the example script was run.\n- Check whether those documents were created from the example provisioning script.","fix":"- Delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.","status":"open","published_at":"2026-11-06T17:17:20+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:44:49+00:00","updated_at":"2026-11-06T17:52:46+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-06T17:44:49Z","model":"claude-haiku-5-5","output":{"fix":"- Delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.","reach":"network","title":"AWS Trusted Remote Execution: SSM setup script lets users run commands as root","impact":"high","summary":"The example SSM document provisioning script in AWS Trusted Remote Execution (REX) before 2026-07-28 has an OS command injection flaw. An authenticated user allowed to invoke the Rex-RO or Rex-RW SSM document can run arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["aws","ssm","trusted-remote-execution","cedar","managed-instances"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Commands run as root on managed instances, bypassing Cedar policy checks.","analyst_note":"","how_to_check":"- Look for Rex-RO and Rex-RW SSM documents in each AWS account and Region where the example script was run.\n- Check whether those documents were created from the example provisioning script.","plain_action":"","needs_analyst":false,"not_affected_if":["never-ran-example-script"],"who_is_affected":"Teams that ran the example AWS Trusted Remote Execution (REX) SSM provisioning script, which created Rex-RO or Rex-RW SSM documents on managed instances. Exposure depends on who is permitted to invoke those documents; teams that never ran the example script are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000725,"input_tokens":4353,"output_tokens":580,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-07':48B '-122193':16A,19A,88C,111C,190C,364C '-173':135C '-2026':15A,18A,87C,110C,189C,363C '-28':49B '00':148C '09':147C '11/06/2026':146C '2026':47B,134C '95g5':367C 'account/region':346C 'affect':273C,296C,321C 'allow':59B 'anyon':304C 'arbitrari':74B 'around':182C 'artifact':291C 'attent':143C 'authent':57B 'aw':1A,20B,41B,136C,138C,213C 'aws-security@amazon.com':372C 'boundari':181C 'bulletin':132C 'bypass':82B 'cedar':21B,83B,172C 'class':277C 'command':11A,53B,75B,97C,120C,193C,259C 'concern':378C 'content':139C 'could':249C 'craft':251C 'creat':212C,306C,342C 'custom':353C 'cve':14A,17A,86C,109C,188C,362C 'date':145C 'delet':336C,352C,357C 'delete-docu':356C 'descript':151C 'disclosur':25B 'document':37B,71B,103C,126C,205C,217C,248C,303C,315C,339C,355C,358C 'due':231C 'email':371C 'enforc':85B 'exampl':35B,101C,124C,198C,207C,235C,297C,329C,351C 'execut':4A,33B,44B,93C,107C,116C,130C,154C,163C 'flaw':55B 'follow':317C 'framework':161C 'ghsa':366C 'ghsa-95g5-m242-wvhr':365C 'guid':95C,118C,319C,332C 'handl':237C 'id':133C 'identifi':187C 'immut':179C 'impact':280C 'import':141C 'includ':208C 'infrastructur':22B 'inject':54B,98C,121C,194C 'input':238C,252C 'instanc':28B,81B,168C,230C,263C 'invok':61B,245C 'issu':89C,112C,195C,279C,286C 'lab':24B 'lab-disclosur':23B 'let':8A 'm242':368C 'manag':27B,80B,167C,215C,229C,262C 'managed-inst':26B 'meant':175C 'none':360C 'open':159C 'open-sourc':158C 'oper':257C 'os':52B,96C,119C,192C 'outsid':264C 'paramet':239C,271C 'permiss':243C 'pleas':370C 'polici':84B,173C 'provid':199C 'provis':38B 'pst':150C 'public':144C 'question':376C 'ran':349C 'recommend':334C 'refer':361C 'remot':3A,32B,43B,92C,106C,115C,129C,153C 'remov':324C 'requir':142C 'resolut':322C 'rex':45B,64B,68B,108C,131C,155C,219C,223C,267C,290C,309C,312C 'rex-ro':63B,218C,308C 'rex-rw':67B,222C,311C 'ro':65B,220C,310C 'root':13A,77B 'run':10A,73B,185C,226C,255C 'rw':69B,224C,313C 'sandbox':164C,268C 'scope':137C 'script':7A,39B,165C,184C,210C,227C,236C 'scriptarg':270C 'secur':180C,375C 'set':203C,301C,327C 'set-up':202C,300C,326C 'setup':6A,94C,117C 'ship':289C 'sign':171C 'sourc':160C 'ssm':5A,29B,36B,70B,102C,125C,216C,247C,314C,338C,354C 'suppli':250C 'system':214C,258C 'trust':2A,31B,42B,91C,105C,114C,128C,152C 'trusted-remote-execut':30B 'type':140C 'unintend':256C 'user':9A,58B,241C 'version':281C,292C 'workaround':359C 'would':254C 'wvhr':369C","nicknames":[],"mitigations":[],"who_affected":"Teams that ran the example AWS Trusted Remote Execution (REX) SSM provisioning script, which created Rex-RO or Rex-RW SSM documents on managed instances. Exposure depends on who is permitted to invoke those documents; teams that never ran the example script are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aws","cedar","critical","infrastructure","labdisclosure","managedinstances","ssm","trustedremoteexecution"],"campaign_type":null,"search_a":"'-122193':16A,19A '-2026':15A,18A 'aw':1A 'command':11A 'cve':14A,17A 'execut':4A 'let':8A 'remot':3A 'root':13A 'run':10A 'script':7A 'setup':6A 'ssm':5A 'trust':2A 'user':9A","search_b":"'-07':48B '-28':49B '2026':47B 'allow':59B 'arbitrari':74B 'authent':57B 'aw':20B,41B 'bypass':82B 'cedar':21B,83B 'command':53B,75B 'disclosur':25B 'document':37B,71B 'enforc':85B 'exampl':35B 'execut':33B,44B 'flaw':55B 'infrastructur':22B 'inject':54B 'instanc':28B,81B 'invok':61B 'lab':24B 'lab-disclosur':23B 'manag':27B,80B 'managed-inst':26B 'os':52B 'polici':84B 'provis':38B 'remot':32B,43B 'rex':45B,64B,68B 'rex-ro':63B 'rex-rw':67B 'ro':65B 'root':77B 'run':73B 'rw':69B 'script':39B 'ssm':29B,36B,70B 'trust':31B,42B 'trusted-remote-execut':30B 'user':58B","search_c":"'-122193':88C,111C,190C,364C '-173':135C '-2026':87C,110C,189C,363C '00':148C '09':147C '11/06/2026':146C '2026':134C '95g5':367C 'account/region':346C 'affect':273C,296C,321C 'anyon':304C 'around':182C 'artifact':291C 'attent':143C 'aw':136C,138C,213C 'aws-security@amazon.com':372C 'boundari':181C 'bulletin':132C 'cedar':172C 'class':277C 'command':97C,120C,193C,259C 'concern':378C 'content':139C 'could':249C 'craft':251C 'creat':212C,306C,342C 'custom':353C 'cve':86C,109C,188C,362C 'date':145C 'delet':336C,352C,357C 'delete-docu':356C 'descript':151C 'document':103C,126C,205C,217C,248C,303C,315C,339C,355C,358C 'due':231C 'email':371C 'exampl':101C,124C,198C,207C,235C,297C,329C,351C 'execut':93C,107C,116C,130C,154C,163C 'follow':317C 'framework':161C 'ghsa':366C 'ghsa-95g5-m242-wvhr':365C 'guid':95C,118C,319C,332C 'handl':237C 'id':133C 'identifi':187C 'immut':179C 'impact':280C 'import':141C 'includ':208C 'inject':98C,121C,194C 'input':238C,252C 'instanc':168C,230C,263C 'invok':245C 'issu':89C,112C,195C,279C,286C 'm242':368C 'manag':167C,215C,229C,262C 'meant':175C 'none':360C 'open':159C 'open-sourc':158C 'oper':257C 'os':96C,119C,192C 'outsid':264C 'paramet':239C,271C 'permiss':243C 'pleas':370C 'polici':173C 'provid':199C 'pst':150C 'public':144C 'question':376C 'ran':349C 'recommend':334C 'refer':361C 'remot':92C,106C,115C,129C,153C 'remov':324C 'requir':142C 'resolut':322C 'rex':108C,131C,155C,219C,223C,267C,290C,309C,312C 'rex-ro':218C,308C 'rex-rw':222C,311C 'ro':220C,310C 'run':185C,226C,255C 'rw':224C,313C 'sandbox':164C,268C 'scope':137C 'script':165C,184C,210C,227C,236C 'scriptarg':270C 'secur':180C,375C 'set':203C,301C,327C 'set-up':202C,300C,326C 'setup':94C,117C 'ship':289C 'sign':171C 'sourc':160C 'ssm':102C,125C,216C,247C,314C,338C,354C 'suppli':250C 'system':214C,258C 'trust':91C,105C,114C,128C,152C 'type':140C 'unintend':256C 'user':241C 'version':281C,292C 'workaround':359C 'would':254C 'wvhr':369C","first_public_at":"2026-11-06T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122193","severity":null,"published_at":"2026-11-06T17:17:20+00:00","modified_at":"2026-11-06T17:17:20+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-173-aws/#CVE-2026-122193","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-173-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T17:52:46+00:00","fetched_at":"2026-11-06T17:52:46+00:00","note":"AWS: CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)"}],"documents":[{"id":88323,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-173-aws/","title":"AWS: CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\n### CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\nBulletin ID: 2026-173-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 09:00 AM PST\n\n Description:\n\nTrusted Remote Execution (REX) is an open-source framework for executing sandboxed scripts on managed instances, where a signed Cedar policy is meant to be the immutable security boundary around each script run.\n\nWe identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS Systems Manager (SSM) documents (Rex-RO and Rex-RW) for running scripts on managed instances. Due to how the example script handled input parameters, a user with permissions to invoke the SSM document could supply crafted input that would run unintended operating system commands on the managed instance, outside of the REX sandbox. The scriptArgs parameter is affected by the same class of issue.\n\nImpacted versions: \n\nThis is not an issue in a shipped REX artifact version. It is an affected example in the set-up documentation. Anyone who created the Rex-RO / Rex-RW SSM documents by following the guide is affected.\n\nResolution:\n\nWe removed this set-up example from the guide. We recommend you delete any SSM documents if you created them, in each account/region where you ran the example:\n\n- Deleting custom SSM documents\n- delete-document\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-122193\n- GHSA-95g5-m242-wvhr\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T17:19:55+00:00","relation":"mentions","confidence":null,"note":null},{"id":88323,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-173-aws/","title":"AWS: CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\n### CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)\n\nBulletin ID: 2026-173-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/06/2026 09:00 AM PST\n\n Description:\n\nTrusted Remote Execution (REX) is an open-source framework for executing sandboxed scripts on managed instances, where a signed Cedar policy is meant to be the immutable security boundary around each script run.\n\nWe identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS Systems Manager (SSM) documents (Rex-RO and Rex-RW) for running scripts on managed instances. Due to how the example script handled input parameters, a user with permissions to invoke the SSM document could supply crafted input that would run unintended operating system commands on the managed instance, outside of the REX sandbox. The scriptArgs parameter is affected by the same class of issue.\n\nImpacted versions: \n\nThis is not an issue in a shipped REX artifact version. It is an affected example in the set-up documentation. Anyone who created the Rex-RO / Rex-RW SSM documents by following the guide is affected.\n\nResolution:\n\nWe removed this set-up example from the guide. We recommend you delete any SSM documents if you created them, in each account/region where you ran the example:\n\n- Deleting custom SSM documents\n- delete-document\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-122193\n- GHSA-95g5-m242-wvhr\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-06T17:19:55+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}