# AWS vulnerabilities Source: https://junglewise.ai/threats/vendors/aws Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/aws.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 87 vulnerabilities in AWS: 6 in the last 7 days and 32 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124848, was published on 10 November 2026. 16 vulnerabilities in the last four weeks, up 100% on the four before (8). 1 critical against 1. 6 technologies have a page of their own. ## Counts - Last 7 days: 6 - Last 30 days: 20 - Last 90 days: 32 - All time: 87 (6 critical, 0 exploited in the wild) ## About AWS Amazon Web Services provides cloud computing infrastructure and platform services. ## Latest AWS vulnerabilities - [CVE-2026-124848: AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt) (high, CVSS 5.5, published 10 Nov 2026) - [CVE-2026-126087: OpenJD Sessions for Python untrusted search path in process launcher](https://junglewise.ai/threats/cve-2026-126087-untrusted-search-path-in-openjd-sessions-for-python-and-the-aws) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-125271: AWS API MCP Server security policy bypass via operation name normalization](https://junglewise.ai/threats/cve-2026-125271-aws-api-mcp-server-security-policy-bypass-via-incorrect) (high, CVSS 7.8, published 10 Nov 2026) - [CVE-2026-124033: AWS ParallelCluster CLI path traversal in log export commands](https://junglewise.ai/threats/cve-2026-124033-relative-path-traversal-in-the-log-export-commands-in-aws) (high, CVSS 6.4, published 9 Nov 2026) - [CVE-2026-119924: Babelfish for PostgreSQL out-of-bounds read in TDS RPC parser](https://junglewise.ai/threats/cve-2026-119924-an-out-of-bounds-read-in-the-tds-rpc-procedure-name-parser-in) (high, CVSS 8.1, published 6 Nov 2026) - [CVE-2026-119923: Babelfish for PostgreSQL heap-based buffer overflow in TDS prelogin parser](https://junglewise.ai/threats/cve-2026-119923-a-heap-based-buffer-overflow-in-the-tds-prelogin-parser-in-the) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-119083: GluonTS arbitrary file write during archive extraction](https://junglewise.ai/threats/cve-2026-119083-gluonts-arbitrary-file-write-during-archive-extraction) (high, CVSS 7.8, published 5 Nov 2026) - [CVE-2026-122192: AWS Firecracker memory access in guest VM after snapshot restore](https://junglewise.ai/threats/cve-2026-122192-guest-access-to-firecracker-process-memory-after-a-failed-memory) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-121652: AWS Amplify maplibre-gl-js-amplify stored XSS in popup rendering](https://junglewise.ai/threats/cve-2026-121652-cross-site-scripting-xss-issue-in-aws-amplify-maplibre-gl-js) (high, CVSS 5.4, published 3 Nov 2026) - [CVE-2026-119922: Babelfish for PostgreSQL privilege escalation](https://junglewise.ai/threats/cve-2026-119922-babelfish-for-postgresql-privilege-escalation) (high, CVSS 8.8, published 3 Nov 2026) - [CVE-2026-120497: AWS AI-DLC Workflows aidlc-traceability stored XSS in HTML report](https://junglewise.ai/threats/cve-2026-120497-stored-cross-site-scripting-xss-in-the-html-report-generator-in) (high, CVSS 5, published 2 Nov 2026) - [CVE-2026-119301: AWS SDK for pandas SQL injection in Iceberg identifier generation](https://junglewise.ai/threats/cve-2026-119301-improper-neutralization-of-quoting-syntax-in-apache-iceberg-sql) (high, CVSS 7.9, published 2 Nov 2026) - [CVE-2026-119148: AWS aws-nitro-enclaves-sdk-c input validation in KMS endpoint](https://junglewise.ai/threats/cve-2026-119148-incomplete-string-validation-in-aws-aws-nitro-enclaves-sdk-c) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-119115: AWS Private CA Connector for Kubernetes authorization bypass in issuer resolution](https://junglewise.ai/threats/cve-2026-119115-incorrect-authorization-in-issuer-resolution-in-aws-private-ca) (high, CVSS 8.5, published 29 Oct 2026) - [CVE-2026-115415: Strands Agents Tools secret masking bypass in environment tool](https://junglewise.ai/threats/cve-2026-115415-secret-masking-bypass-in-the-environment-tool-in-strands-agents) (high, CVSS 6.5, published 28 Oct 2026) - [CVE-2026-118029: AWS SDK for pandas Athena query result location ownership bypass](https://junglewise.ai/threats/cve-2026-118029-unverified-ownership-of-the-default-athena-query-result-location) (high, CVSS 5.9, published 28 Oct 2026) - [CVE-2026-115413: AWS API MCP Server OAuth token audience validation bypass](https://junglewise.ai/threats/cve-2026-115413-aws-api-mcp-server-oauth-token-audience-validation-bypass) (high, CVSS 7.8, published 27 Oct 2026) - [CVE-2026-115845: AWS MCP Server incomplete validation in run_script sandbox](https://junglewise.ai/threats/cve-2026-115845-incomplete-validation-in-the-run-script-python-sandbox-in-aws) (high, CVSS 6.4, published 23 Oct 2026) - [CVE-2026-115417: AWS aws-c-mqtt memory exhaustion in MQTT 3.1.1 adapter](https://junglewise.ai/threats/cve-2026-115417-memory-allocation-with-excessive-size-value-in-the-mqtt-3-1-1) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115414: AWS SAM CLI command injection in Terraform hook](https://junglewise.ai/threats/cve-2026-115414-os-command-injection-issue-in-sam-cli-terraform-hook) (high, CVSS 7.8, published 22 Oct 2026) - [CVE-2026-108096: AWS Amplify API Category improper authorization in query resolvers](https://junglewise.ai/threats/cve-2026-108096-improper-authorization-in-query-resolvers-for-sql-backed-models) (high, CVSS 6.5, published 9 Oct 2026) - [CVE-2026-107608: AWS CDK improper link resolution in asset bundling output](https://junglewise.ai/threats/cve-2026-107608-improper-link-resolution-in-asset-bundling-output-handling-in) (high, CVSS 5.5, published 8 Oct 2026) - [CVE-2026-105811: AWS QnABot authorization bypass in Lambda hook sample](https://junglewise.ai/threats/cve-2026-105811-authorization-bypass-through-a-user-controlled-key-in-the) (high, CVSS 6.5, published 6 Oct 2026) - [CVE-2026-103956: Loom for AWS authentication bypass and credential disclosure](https://junglewise.ai/threats/cve-2026-103956-and-issues-in-loom-for-aws) (critical, CVSS 10, published 2 Oct 2026) - [CVE-2026-104002: AWS Powertools for Lambda (Python) data masking fail-open error handling](https://junglewise.ai/threats/cve-2026-104002-fail-open-error-handling-in-the-data-masking-utility-in) (high, CVSS 5.3, published 1 Oct 2026) ## Most severe AWS vulnerabilities - [CVE-2026-103956: Loom for AWS authentication bypass and credential disclosure](https://junglewise.ai/threats/cve-2026-103956-and-issues-in-loom-for-aws) (critical, CVSS 10, published 2 Oct 2026) - [CVE-2026-119923: Babelfish for PostgreSQL heap-based buffer overflow in TDS prelogin parser](https://junglewise.ai/threats/cve-2026-119923-a-heap-based-buffer-overflow-in-the-tds-prelogin-parser-in-the) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-13763: AWS Application Load Balancer WAF bypass via HTTP/2 multi-frame requests](https://junglewise.ai/threats/cve-2026-13763-aws-application-load-balancer-waf-bypass-via-http-2-multi-frame) (critical, CVSS 9.8, published 29 Jun 2026) - [CVE-2026-85228: AWS Deep Java Library integer overflow in tensor buffer validation](https://junglewise.ai/threats/cve-2026-85228-aws-deep-java-library-integer-overflow-in-tensor-buffer) (critical, CVSS 9.1, published 10 Sep 2026) - [CVE-2026-11393: AWS AgentCore CLI code injection in Bedrock Agent import](https://junglewise.ai/threats/cve-2026-11393-aws-agentcore-cli-code-injection-in-bedrock-agent-import) (critical, CVSS 9, published 8 Jun 2026) - [CVE-2025-4318: AWS Amplify Studio eval injection in amplify-codegen-ui](https://junglewise.ai/threats/cve-2025-4318-aws-amplify-studio-eval-injection-in-amplify-codegen-ui) (critical, CVSS 4, published 30 Jul 2026) - [CVE-2026-96883: AWS pgcollection type confusion remote code execution](https://junglewise.ai/threats/cve-2026-96883-aws-pgcollection-type-confusion-remote-code-execution) (high, CVSS 8.8, published 24 Sep 2026) - [CVE-2026-49473: AWS Cedar Policy Express.js middleware authorization bypass via query string manipulation](https://junglewise.ai/threats/cve-2026-49473-aws-cedar-policy-express-js-middleware-authorization-bypass-via) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-126087: OpenJD Sessions for Python untrusted search path in process launcher](https://junglewise.ai/threats/cve-2026-126087-untrusted-search-path-in-openjd-sessions-for-python-and-the-aws) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-119922: Babelfish for PostgreSQL privilege escalation](https://junglewise.ai/threats/cve-2026-119922-babelfish-for-postgresql-privilege-escalation) (high, CVSS 8.8, published 3 Nov 2026) ## Vulnerabilities per week 16 vulnerabilities in the last four weeks, up 100% on the four before (8). 1 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 4 | 1 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 3 | 1 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 5 | 0 | 0 | | 2 Nov 2026 | 8 | 1 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## AWS technologies - [AWS Cloud Development Kit](https://junglewise.ai/threats/technologies/cdk): 10 vulnerabilities - [AWS Kiro IDE](https://junglewise.ai/threats/technologies/kiro-ide): 7 vulnerabilities - [AWS API MCP Server](https://junglewise.ai/threats/technologies/api-mcp-server): 4 vulnerabilities - [AWS-LC](https://junglewise.ai/threats/technologies/lc): 4 vulnerabilities - [Aws-Lc-Sys](https://junglewise.ai/threats/technologies/aws-lc-sys): 3 vulnerabilities - [AWS Babelfish for PostgreSQL](https://junglewise.ai/threats/technologies/babelfish-for-postgresql): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "AWS vulnerabilities", https://junglewise.ai/threats/vendors/aws, 12 November 2026.