# CVE-2026-105811: Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

> CVE-2026-105811: Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-105811
Last updated: 2026-10-07T16:17:34Z

- Published: 2026-10-06 20:03 UTC · Updated: 2026-10-07 16:17 UTC · Assigner: AMZN
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.33%, 26th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-639

## Description

Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda\_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account. This sample solution provides an example Lambda hook and requires separate, manual deployment and additional setup. It is not deployed automatically with QnABot. Customers who have not deployed this optional sample hook are not affected and do not need to take action.  To remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix.

## Affected vendors and products

- aws: qnabot-on-aws

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-105811)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105811)
- [https://github.com/aws-solutions-library-samples/qnabot-on-aws/releases/tag/v7.4.6](https://github.com/aws-solutions-library-samples/qnabot-on-aws/releases/tag/v7.4.6)
- [https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-126-aws/](https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-126-aws/)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-105811 · Markdown: https://rewindex.com/cve/CVE-2026-105811.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-105811 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:30.316Z