---
id: "CVE-2026-124501"
page: "https://infrastack.ai/live/CVE-2026-124501"
kind: "vulnerability"
aliases: ["CVE-2026-124501"]
title: "moto: AWS Batch emulation flaw allows improper privilege management"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws-batch", "moto", "package", "python", "testing"]
not_affected_if: ["batch-not-mocked", "moto-above-5.2.4", "moto-not-used"]
published_at: "2026-11-09T00:18:01+00:00"
first_seen_at: "2026-11-09T00:23:39+00:00"
updated_at: "2026-11-09T00:25:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124501", "first_seen_at": "2026-11-09T00:23:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T00:25:33+00:00"}]
exploit_sources: []
---

# moto: AWS Batch emulation flaw allows improper privilege management

Link for people: https://infrastack.ai/live/CVE-2026-124501 (this .md is for agents)

Moto is a Python library that mocks AWS services for tests. A flaw in its AWS Batch emulation lets a crafted privileged or volumes argument escalate privileges, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run pip show moto, or look for moto in requirements.txt, pyproject.toml or poetry.lock, and note the version (reported affected: up to 5.2.4).
- Check whether your tests use the moto Batch mock (mock_batch / mock_aws with Batch) and pass privileged or volumes values taken from untrusted input.
- Also check any shared or CI server that exposes moto in server mode on a network.

## Timeline

- 2026-11-09T00:23:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124501
- 2026-11-09T00:25:33+00:00 analyst — Could not confirm from primary sources: web-cli out of Exa credits, NVD page did not render via WebFetch. NVD description (via signal) says moto up to 5.2.4 affected, public exploit reported, vendor never responded. moto releases page lists 5.2.5 (27 Oct) with no release notes, so no confirmed fix; whether 5.2.5 fixes this is unknown. Exploit link not found, nothing verified. Settle by reading the NVD references for the exploit/issue link and the 5.2.5 diff of moto/batch/models.py.

## From the sources

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_