# CVE-2026-103956: Missing authentication for critical function in Loom for AWS

> CVE-2026-103956: Missing authentication for critical function in Loom for AWS. CVSS 10.0 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-103956
Last updated: 2026-10-09T16:36:18Z

- Published: 2026-10-02 19:06 UTC · Updated: 2026-10-09 16:36 UTC · Assigner: AMZN
- CVSS: 10.0 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS: 2.5%, 85th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1188, CWE-306

## Description

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

## Affected vendors and products

- AWS: loom

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-103956)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-103956)
- [https://aws.amazon.com/security/security-bulletins/2026-124-aws/](https://aws.amazon.com/security/security-bulletins/2026-124-aws/)
- [https://github.com/awslabs/loom/releases/tag/v1.6.1](https://github.com/awslabs/loom/releases/tag/v1.6.1)
- [https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp](https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-103956 · Markdown: https://rewindex.com/cve/CVE-2026-103956.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-103956 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:18.743Z