CVE-2026-18481: AWS Ops Wheel stored XSS in participant URL handling

CVE-2026-18481 · Severity: high · CVSS 7.3 · Published 2026-07-31

AWS has a stored XSS vulnerability in a Participant URL field that allows attackers to inject malicious code. When users interact with the affected feature, the injected code executes in their browser and can steal session tokens, leading to complete account compromise and unauthorized access to AWS resources.

Technologies: Amazon AWS. Vendors: Amazon, Amazon Web Services.

Quick answers

Is CVE-2026-18481 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18481 being exploited in the wild.
How severe is CVE-2026-18481?
High severity, with a CVSS score of 7.3, published 31 July 2026.
Which products and versions are affected?
Amazon Web Services Ops Wheel before PR #168.
Is there a fix for CVE-2026-18481?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18481 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-18481?
Check whether you run Amazon AWS, Amazon AWS Management Console or Amazon Web Services Ops Wheel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a stored cross-site scripting (XSS) flaw in the Participant URL field, where unsanitized user input is persisted and later reflected to users' browsers without proper encoding. An attacker can craft a malicious URL containing JavaScript payload and submit it via the Participant URL field; when other users view or interact with this field, the payload executes in their browser context. The attack requires an attacker to have access to submit or modify participant URLs, but no network-level authentication bypass is needed from the victim's perspective. Successful exploitation allows an attacker to steal session tokens or cookies, enabling account takeover and full access to the victim's AWS account and resources. AWS has issued a security bulletin (CVE-2026-18481) and patches are available through official AWS channels.

Affected products

  • AWS AWS Management Console or AWS service with Participant URL feature

Timeline

  • 2026-09-22: disclosed: CVE-2026-18481 published via AWS Security Bulletins

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.