{"id":"CVE-2026-21830","kind":"vulnerability","aliases":["CVE-2026-21830"],"related":[],"title":"HCL BigFix AEX: aws-sdk flaw may send AWS requests to wrong endpoints","description":"HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.","summary":"HCL BigFix AEX ships a bundled aws-sdk package with a flaw that can cause AWS API requests to be sent to unintended or non-AWS endpoints. An attacker who can influence endpoint routing could receive request data, such as credentials or payloads, meant for AWS.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aex","aws","bigfix","self-hosted","vendor"],"not_affected_if":["no-bigfix-aex"],"how_to_check":"- Confirm whether BigFix AEX is installed in your environment and note its version.\n- Check the vendor advisory for the affected BigFix AEX versions: unknown\n- Review AEX configuration for custom AWS endpoint or proxy settings: unknown","fix":"- Apply the HCL BigFix AEX update that addresses the aws-sdk issue: unknown\n- Check the vendor advisory for the fixed version: unknown","status":"open","published_at":"2026-10-28T13:17:07+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:26+00:00","updated_at":"2026-10-28T13:34:26+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-28T13:34:26Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the HCL BigFix AEX update that addresses the aws-sdk issue: unknown\n- Check the vendor advisory for the fixed version: unknown","reach":"unknown","title":"HCL BigFix AEX: aws-sdk flaw may send AWS requests to wrong endpoints","impact":"low","summary":"HCL BigFix AEX ships a bundled aws-sdk package with a flaw that can cause AWS API requests to be sent to unintended or non-AWS endpoints. An attacker who can influence endpoint routing could receive request data, such as credentials or payloads, meant for AWS.","category":"vendor","nicknames":[],"who_cares":["bigfix","aex","aws","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"AWS requests and their data sent to an unintended endpoint","analyst_note":"Find the HCL advisory for CVE-2026-21830 to get affected and fixed AEX versions, and the trigger conditions.","how_to_check":"- Confirm whether BigFix AEX is installed in your environment and note its version.\n- Check the vendor advisory for the affected BigFix AEX versions: unknown\n- Review AEX configuration for custom AWS endpoint or proxy settings: unknown","needs_analyst":true,"not_affected_if":["no-bigfix-aex"],"who_is_affected":"Teams running HCL BigFix AEX that uses the bundled aws-sdk to call AWS APIs. The sources do not describe which AEX configurations trigger the flaw, so exposure beyond that is unknown. Teams not running BigFix AEX can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000632,"input_tokens":3271,"output_tokens":610,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-21830':17A,20A '..':91C 'aex':3A,21B,30B,78C 'affect':81C 'api':45B,96C 'attack':58B 'aw':5A,10A,22B,35B,44B,55B,75B,88C,95C,105C 'aws-sdk':4A,34B,87C 'bigfix':2A,23B,29B,77C 'bundl':33B 'caus':43B,94C 'could':64B 'credenti':70B 'cve':15A,18A 'data':67B 'endpoint':14A,56B,62B,106C 'flaw':7A,40B 'hcl':1A,28B,76C 'host':26B 'influenc':61B 'may':8A,93C 'meant':73B 'non':54B,104C 'non-aw':53B 'packag':37B,90C 'payload':72B 'product':79C 'receiv':65B 'request':11A,46B,66B,97C 'rout':63B 'sdk':6A,36B,89C 'self':25B 'self-host':24B 'send':9A 'sent':49B,100C 'ship':31B 'unintend':51B,102C 'vendor':27B 'vulner':84C 'wrong':13A","nicknames":[],"mitigations":[],"who_affected":"Teams running HCL BigFix AEX that uses the bundled aws-sdk to call AWS APIs. The sources do not describe which AEX configurations trigger the flaw, so exposure beyond that is unknown. Teams not running BigFix AEX can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-21830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21830","severity":null,"published_at":"2026-10-28T13:17:07+00:00","modified_at":"2026-10-28T13:17:07+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}