CVE-2026-103958
HighCVSS 7.6Summary
Loom for AWS before 1.7.0 contains a server-side request forgery vulnerability in the tool server and remote agent connection handling. An authenticated remote user can obtain the credentials of the application's own container role and read responses from arbitrary internal network locations by supplying a crafted connection address when registering, updating, or testing a tool server or remote agent.
Risk Assessment
The vulnerability allows credential theft and access to internal network resources, potentially compromising the entire cloud infrastructure.
Recommendation
Upgrade Loom for AWS to version 1.7.0 or later. Additionally, restrict access to tool server registration and testing functions.
Other vulnerabilities in Loom for AWS
See all- CVE-2026-103957Medium
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations. This is achieved via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication.
- CVE-2026-103956Critical
Missing authentication for a critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.
Original NVD description (English source)
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS