--- id: "GHSA-x7f2-wxc8-qpxq" kind: "vulnerability" aliases: ["GHSA-x7f2-wxc8-qpxq"] title: "CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws" severity: "unknown" cvss: null epss: null exploited: false status: "open" category: "ai-tooling" products: [] ecosystems: [] tags: ["ai-coding-agents", "ai-tooling", "aurora-dsql", "aws", "databases-on-aws", "lab-disclosure"] not_affected_if: ["helper-not-used", "version-1.7.1-or-later"] published_at: null first_seen_at: "2026-10-24T19:28:15+00:00" updated_at: "2026-10-25T04:51:32+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/", "first_seen_at": "2026-10-24T19:28:15+00:00"}] --- # CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws The databases-on-aws plugin for AWS Agent Plugins, versions 1.0.0 through 1.7.0, has an incomplete input filter in its optional psql connection helper. A remote unauthenticated actor can supply crafted content that an AI coding agent ingests; if the agent then invokes the helper with that database command value, operating-system commands run with the helper process's permissions. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the installed databases-on-aws plugin version in each agent environment and whether it is below `1.7.1`. - Check whether the pinned repository revision is older than commit `8b13a503746a4ebb0402b936645163224058bde3`. - Check whether the agent uses the psql connection helper command path. ## Fix - Upgrade databases-on-aws to `1.7.1` or later, or to commit `8b13a503746a4ebb0402b936645163224058bde3` or later if pinned to a repository revision. - Verify the updated plugin is active in every environment and in any forked or derivative code. - Until upgraded, avoid the psql connection helper and use manually reviewed SQL or the DSQL MCP server instead. - If the helper host may have been accessed inappropriately, rotate or revoke the AWS credentials and review database roles available to that process. ## Mitigated for you by - Team (workaround): covers The databases-on-aws plugin's optional psql connection helper command path, avoided by using only manually reviewed SQL or the DSQL MCP server provided through the plugin instead of the helper. Limits: Does not remove or fix the vulnerable code; the helper stays installed and any use of it remains exposed until the plugin is upgraded to 1.7.1 or later. Still: Stop using the psql connection helper command path; run only manually reviewed SQL or use the DSQL MCP server, and upgrade databases-on-aws to 1.7.1 or later when scheduled. https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/ - Team (workaround): covers Limits the permissions available to the process if the helper is invoked with a crafted command: runs as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped, preferably read-only database role Limits: Reduces impact only; command execution on the host is still possible and the flaw is not fixed Still: Run the agent and helper as an unprivileged OS user, grant only dsql:DbConnect with a scoped database role (preferably read-only), do not grant dsql:DbConnectAdmin for routine use, and rotate or revoke credentials and database role mappings if the helper host may have been inappropriately accessed https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/ - Team (workaround): covers Limits the permissions available to the agent and helper process if the helper is invoked. Limits: Reduces impact only; any command the helper runs still executes with the process's permissions, and the flaw is not fixed. Still: Run the agent and helper as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped, preferably read-only database role; do not use admin or grant dsql:DbConnectAdmin for routine operations. https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/ ## Timeline - 2026-10-24T19:28:15+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/ — AWS: CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws ## Documents - [advisory] AWS: CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws https://aws.amazon.com/security/security-bulletins/rss/2026-130-aws/ ## From the sources CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws ### CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws Bulletin ID: 2026-130-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 11:30 AM PDT Description: Amazon Agent Plugins for AWS is an open source collection of plugins that extends supported AI coding agents with AWS-focused workflows and tool integrations. The databases-on-aws plugin provides database design, development, migration, and operational guidance, including Aurora DSQL helper scripts. We identified CVE-2026-107322, where an incomplete list of disallowed inputs in databases-on-aws versions before 1.7.1 could allow a remote unauthenticated actor to supply crafted content that an agent ingests. The affected code is not a listening network service; operating-system command execution on the host is possible only if the agent subsequently invokes the local helper with the crafted database command value. Any resulting command runs with the permissions of the process running the helper. This issue does not affect the Aurora DSQL service or bypass database privileges. Impacted versions: databases-on-aws versions 1.0.0 through 1.7.0 Resolution: The fix is included in databases-on-aws 1.7.1 and later and became available from the marketplace, which is served from the repository's main branch, on August 26, 2026. We recommend upgrading to the latest version, verifying that the updated plugin is active in every environment where it is used, and ensuring any forked or derivative code incorporates the fix. Customers using a pinned repository revision should use commit 8b13a503746a4ebb0402b936645163224058bde3 or later rather than relying on a 1.7.1 release tag. Workarounds: Customers who cannot immediately upgrade should avoid the optional psql connection helper command path and use only manually reviewed SQL, or use the DSQL MCP server provided through the plugin instead of the helper. Running the agent and helper as an unprivileged operating-system user with a dedicated AWS IAM role limited to dsql:DbConnect and a scoped database role, preferably read-only where appropriate, further limits the permissions available to the process. Do not use admin or grant dsql:DbConnectAdmin for routine agent operations. Customers who have reason to believe the helper host was inappropriately accessed should rotate or revoke the AWS credentials accessible to that process and review, revoke, or replace the database roles and IAM-to-database role mappings available to it. These measures reduce potential impact while an upgrade is scheduled; upgrading remains the recommended resolution. References: - CVE-2026-107322 - GHSA-x7f2-wxc8-qpxq Acknowledgement: We would like to thank Shay Sakazi (@shaysakazi) for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_