{"id":"GHSA-hhhc-wq73-w43x","kind":"vulnerability","aliases":["GHSA-hhhc-wq73-w43x"],"related":[],"title":"CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS","description":"CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS\n\n### CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS\n\nBulletin ID: 2026-126-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:00 PM PDT\n\nDescription:\n\nQnABot on AWS is a sample solution of a multi-channel, multi-language conversational interface (chatbot) that responds to your customer's questions, answers, and feedback. We identified CVE-2026-105811 in the optional Amazon Q Business Lambda hook sample of QnABot on AWS. The Amazon Q Business Lambda hook sample (q-business-lambda-hook) is an optional integration sample included in the QnABot on AWS repository. It requires separate, manual deployment and additional setup; it is not deployed automatically with QnABot. Customers who have not deployed this sample are not affected and do not need to take action.\n\nAuthorization bypass through a user-controlled key in the sample included with QnABot on AWS versions 7.0.0 through 7.4.5 might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account.\n\nTo remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix.\n\nImpacted versions: >=7.0.0, <7.4.6\n\nResolution:\n\nThis issue has been addressed in QnABot on AWS version v7.4.6. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix. No action is required for customers who do not currently use the Amazon Q Business Lambda hook sample stack.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-105811\n- GHSA-hhhc-wq73-w43x\n\nAcknowledgement:\n\nWe would like to thank Oren Yomtov for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The optional Amazon Q Business Lambda hook sample in QnABot on AWS versions 7.0.0 through 7.4.5 has an authorization bypass through a user-controlled key. An authenticated remote user can read arbitrary Amazon S3 objects in the AWS account where it is deployed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","q-business","qnabot","s3","self-hosted","vendor"],"not_affected_if":["hook-sample-not-deployed","qnabot-7.4.6-or-later"],"how_to_check":"- Check whether the Amazon Q Business Lambda hook sample stack (q-business-lambda-hook) is deployed in your AWS account, separately from the QnABot stack.\n- Check the deployed QnABot on AWS version; versions `7.0.0` through `7.4.5` are affected.","fix":"- Update the QnABot on AWS stack to `7.4.6` or later.\n- Redeploy the Amazon Q Business Lambda hook sample stack after the update; updating QnABot alone does not deliver the fix.\n- Patch any forked or derivative code with the same changes.","status":"open","published_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","triaged_at":"2026-10-25T04:51:37+00:00","updated_at":"2026-10-25T04:51:37+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T04:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the QnABot on AWS stack to `7.4.6` or later.\n- Redeploy the Amazon Q Business Lambda hook sample stack after the update; updating QnABot alone does not deliver the fix.\n- Patch any forked or derivative code with the same changes.","reach":"internet","title":"AWS QnABot: Q Business hook sample lets authenticated users read any S3 object","impact":"medium","summary":"The optional Amazon Q Business Lambda hook sample in QnABot on AWS versions 7.0.0 through 7.4.5 has an authorization bypass through a user-controlled key. An authenticated remote user can read arbitrary Amazon S3 objects in the AWS account where it is deployed.","category":"vendor","nicknames":[],"who_cares":["aws","qnabot","q-business","s3","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated users read arbitrary S3 objects in the deploying AWS account","analyst_note":"","how_to_check":"- Check whether the Amazon Q Business Lambda hook sample stack (q-business-lambda-hook) is deployed in your AWS account, separately from the QnABot stack.\n- Check the deployed QnABot on AWS version; versions `7.0.0` through `7.4.5` are affected.","needs_analyst":false,"not_affected_if":["hook-sample-not-deployed","qnabot-7.4.6-or-later"],"who_is_affected":"Only teams that manually deployed the optional Amazon Q Business Lambda hook sample alongside QnABot on AWS versions 7.0.0 through 7.4.5 are exposed. The sample is not deployed automatically, so QnABot installations without it need no action. Teams running forks of the sample should also check their code.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4194,"output_tokens":655,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105811':3A,93C,116C,189C,438C '-126':140C '-2026':2A,92C,115C,188C,437C '00':153C '10/06/2026':151C '13':152C '2026':139C '7.0.0':60B,276C,339C '7.4.5':62B,278C '7.4.6':311C,340C,384C 'account':86B,295C 'acknowledg':444C 'action':258C,411C 'addit':233C 'address':346C 'affect':251C,300C 'allow':280C 'alon':331C,404C 'amazon':14A,49B,80B,104C,127C,193C,204C,288C,318C,391C,422C 'answer':182C 'arbitrari':79B,287C 'attent':148C 'authent':74B,282C 'author':4A,65B,94C,117C,259C 'automat':239C 'avail':434C 'aw':23A,34B,58B,85B,113C,136C,141C,143C,159C,202C,225C,274C,294C,307C,329C,350C,380C,402C 'aws-security@amazon.com':465C 'bulletin':137C 'busi':16A,40B,51B,106C,129C,195C,206C,212C,320C,393C,424C 'bypass':5A,66B,95C,118C,260C 'channel':168C 'chatbot':174C 'code':366C 'collabor':453C 'concern':471C 'content':144C 'control':10A,71B,100C,123C,265C 'convers':172C 'coordin':459C 'current':419C 'custom':179C,242C,301C,374C,415C 'cve':1A,91C,114C,187C,436C 'date':150C 'deliv':334C,407C 'deploy':90B,231C,238C,246C,293C 'deriv':365C 'descript':156C 'disclosur':37B,461C 'email':464C 'ensur':361C 'feedback':184C 'fix':336C,373C,409C 'fork':363C 'ghsa':25A,30A,440C 'ghsa-hhhc-wq73-w43x':24A,29A,439C 'hhhc':26A,31A,441C 'hook':18A,53B,108C,131C,197C,208C,214C,322C,395C,426C 'host':45B 'id':138C 'identifi':186C 'impact':337C 'import':146C 'includ':220C,270C 'incorpor':370C 'integr':218C 'interfac':173C 'issu':299C,343C,456C 'key':11A,72B,101C,124C,266C 'lab':36B 'lab-disclosur':35B 'lambda':17A,52B,107C,130C,196C,207C,213C,321C,394C,425C 'languag':171C 'later':313C,386C 'latest':358C 'like':447C 'manual':230C 'might':279C 'multi':167C,170C 'multi-channel':166C 'multi-languag':169C 'need':255C 'new':372C 'object':82B,290C 'option':48B,192C,217C 'oren':450C 'patch':368C 'pdt':155C 'pleas':463C 'pm':154C 'process':462C 'public':149C 'q':15A,39B,50B,105C,128C,194C,205C,211C,319C,392C,423C 'q-busi':38B 'q-business-lambda-hook':210C 'qnabot':21A,41B,56B,111C,134C,157C,200C,223C,241C,272C,305C,327C,348C,378C,400C 'question':181C,469C 'read':78B,286C 'recommend':354C 'redeploy':316C,389C 'refer':435C 'remedi':297C 'remot':75B,283C 'repositori':226C 'requir':147C,228C,413C 'resolut':341C 'respond':176C 's3':42B,81B,289C 'sampl':19A,54B,109C,132C,162C,198C,209C,219C,248C,269C,323C,396C,427C 'scope':142C 'secur':468C 'self':44B 'self-host':43B 'separ':229C 'setup':234C 'solut':163C 'stack':308C,324C,330C,381C,397C,403C,428C 'take':257C 'thank':449C 'type':145C 'updat':303C,325C,376C,398C 'upgrad':355C 'use':420C 'user':9A,70B,76B,99C,122C,264C,284C 'user-control':8A,69B,98C,121C,263C 'v7.4.6':352C 'vendor':46B 'version':59B,275C,310C,338C,351C,359C,383C 'vulner':460C 'w43x':28A,33A,443C 'workaround':429C,433C 'would':446C 'wq73':27A,32A,442C 'yomtov':451C","nicknames":[],"mitigations":[],"who_affected":"Only teams that manually deployed the optional Amazon Q Business Lambda hook sample alongside QnABot on AWS versions 7.0.0 through 7.4.5 are exposed. The sample is not deployed automatically, so QnABot installations without it need no action. Teams running forks of the sample should also check their code.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-126-aws/#GHSA-hhhc-wq73-w43x","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-126-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","fetched_at":"2026-10-24T18:56:55+00:00","note":"AWS: CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS"}],"documents":[{"id":2915,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-126-aws/","title":"AWS: CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS","kind":"advisory","source":"lab","text":"CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS\n\n### CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS\n\nBulletin ID: 2026-126-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:00 PM PDT\n\nDescription:\n\nQnABot on AWS is a sample solution of a multi-channel, multi-language conversational interface (chatbot) that responds to your customer's questions, answers, and feedback. We identified CVE-2026-105811 in the optional Amazon Q Business Lambda hook sample of QnABot on AWS. The Amazon Q Business Lambda hook sample (q-business-lambda-hook) is an optional integration sample included in the QnABot on AWS repository. It requires separate, manual deployment and additional setup; it is not deployed automatically with QnABot. Customers who have not deployed this sample are not affected and do not need to take action.\n\nAuthorization bypass through a user-controlled key in the sample included with QnABot on AWS versions 7.0.0 through 7.4.5 might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account.\n\nTo remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix.\n\nImpacted versions: >=7.0.0, <7.4.6\n\nResolution:\n\nThis issue has been addressed in QnABot on AWS version v7.4.6. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix. No action is required for customers who do not currently use the Amazon Q Business Lambda hook sample stack.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-105811\n- GHSA-hhhc-wq73-w43x\n\nAcknowledgement:\n\nWe would like to thank Oren Yomtov for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}