Loom for AWS Gave Every Unauthenticated Request Super-Admin — CVE-2026-103956

On 2 October 2026, AWS published Security Bulletin 2026-124-AWS, disclosing CVE-2026-103956 in Loom for AWS, the AWS Labs open-source platform for building, deploying and managing AI agents on Amazon Bedrock AgentCore Runtime. In a deployment where no identity provider had been configured, the backend's authentication dependency handed a fixed super-admin identity to every incoming request — including requests carrying no Authorization header at all. A remote client able to reach the backend could register tool servers, read stored integration credentials, and rewrite the IAM role policies attached to managed agent roles: full administrative control of the agent control plane with zero authentication. NVD scores the flaw 10.0, critical, under both CVSS 3.1 and CVSS 4.0. Credit for the finding went to Kenneth Cox, working through coordinated disclosure. The advisory describes what the flaw would allow; it does not describe what anyone did with it.

What the authentication dependency was actually doing

The defect sat in the backend's auth dependency. According to the GitHub advisory GHSA-vgmj-998f-r8mp, the code path in the backend's auth dependency — the get_current_user function in the Loom backend — returned a hard-coded administrator identity, a super-admin account in the g-admins-super group, whenever no Amazon Cognito user pool and no active external identity provider existed. It did not check whether the caller had presented a token. It did not fall through to a rejection. It returned the administrator identity anyway.

The AWS bulletin describes the consequence the same way: the flaw let any network client obtain full administrative authority over the agent control plane. CVE-2026-103956 is mapped to CWE-306 (missing authentication for a critical function) and CWE-1188 (insecure default initialization of a resource). NVD's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, scope changed, full impact on confidentiality, integrity and availability.

The important framing, and the part that explains why a CVSS 10.0 landed on a small open-source project, is that an IdP-less deployment is not exotic. A fresh Loom install that has not yet had Cognito wired up is in exactly that state, and so is a deployment whose identity provider configuration was never set or stopped resolving. The advisory treats this as a common condition rather than a misconfiguration the operator had to invite.

What an unauthenticated client could reach

• Agent registrations and tool servers: the client could register or alter the tool servers an agent is allowed to call, which in a tool-calling architecture is the difference between an agent that reads a ticket and an agent that runs something.

• Stored integration credentials: the platform stores credentials for the external systems its agents and tool servers connect to, and the bulletin states those were readable.

• IAM role policies on managed agent roles: the advisory describes rewriting the IAM role policies attached to the roles Loom manages for its agents, which is the step that converts control of the orchestration layer into control of what the agents can do inside the AWS account.

• Everything else the platform manages: agents, memories, authorizer and security configuration, settings — and invoking any agent the deployment runs.

Those four items are the advisory's own list of what full administrative access reaches, not a reconstruction. No exploitation is claimed to have used any of them.

Established, and not established

Established. The vulnerability existed and is documented in agreed primary sources: AWS's Security Bulletin 2026-124-AWS of 2 October 2026, the GitHub advisory GHSA-vgmj-998f-r8mp published the same day, and NVD's CVE-2026-103956 record. The affected versions (before 1.6.1), the CVSS scores, the CWE mappings, the fix version and the credit are consistent across them. The archive record for this incident is graded confidence A, not disputed, and carries real_harm as false.

The record's own fields place the disclosure on 2 October 2026, with day precision, and describe a public proof-of-concept claim as unverified; neither the bulletin nor the advisory carries evidence of an attack. NVD's public record for CVE-2026-103956 lists CISA's known-exploited catalogue as empty for this CVE, and the archive record carries real_harm as false. So: a flaw an unauthenticated network client could use, with no evidence in the sources that anyone did.

Also worth separating. The CVSS 10.0 measures what the flaw would allow, not what it did. A 10.0 with no exploitation and no recorded harm is a near-miss, and the archive files it that way.

The fix, and the two-month gap before it was named

AWS fixed the issue in Loom 1.6.1, released on 4 August 2026. That date matters: the release came about two months before the bulletin and the CVE number existed publicly. The v1.6.1 release notes describe the change without naming a CVE — the auth bypass now requires an explicit opt-in plus a loopback client, and otherwise fails closed with a 401 — so the flaw's severity and its designation were only visible to Loom users tracking the trackers, not to anyone reading the release notes alone. The same release added SSRF hardening for OAuth discovery fetches.

For deployments already exposed, AWS's pre-upgrade guidance is to have an Amazon Cognito user pool or an active external identity provider fully configured before the backend is reachable beyond loopback, to confirm LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset outside local development, and to restrict network or security-group access to the backend in the meantime. The bulletin is explicit that network restriction lowers the chance of unintended access but does not close the issue without the upgrade, and that forks and derivative code need patching too.

Same bulletin, different flaws

The record's summary notes that 2026-124-AWS is not only about this CVE. Two more Loom issues were disclosed the same day and fixed in Loom 1.7.0: CVE-2026-103957, an SSRF in OAuth2 discovery handling that could send OAuth2 client secrets or another user's access token to an attacker-controlled endpoint (CVSS 3.1 6.2, CVSS 4.0 8.2), and CVE-2026-103958, an SSRF in tool server and remote agent connection handling that could reach arbitrary internal addresses, including the container's credential-vending endpoint, and read the responses (CVSS 3.1 7.6, CVSS 4.0 8.3). Both required an authenticated user holding the mcp:write or a2a:write scope. The bulletin also covers CVE-2026-104019, an OS command injection in the Studio Space startup validation script used by Amazon SageMaker Unified Studio, scored 9.0 critical under CVSS 3.1, which AWS says it fixed server-side with a global sanitising change applied at the next Space restart.

Post-upgrade, AWS asks operators to rotate OAuth2 client secrets for MCP and A2A integrations, revoke and re-issue tokens that were active during the affected window, and — if container role credentials were reached — rotate the IAM role's session credentials and review CloudTrail.

Why this record is in the archive

CVE-2026-103956 is filed as a vulnerability, not an incident: found, not necessarily exploited, INFRA and CRED, GLOBAL, high severity, high confidence. Its value in the record set is as a boundary case for the whole category of agent control planes. Loom's job is to hold the identities, the tool-server registrations along with their integration credentials, and the IAM policies that decide what agents may touch — the layer that connects an agent platform to the cloud account it lives in. A missing check in that layer does not degrade an agent; it transfers the estate. A sibling record in the archive, the 8 October 2026 AgentCorruption disclosure against Amazon Bedrock AgentCore, describes the same layer being reached by a different road, an SSRF chain from one public-facing agent.

The archive lists every documented agent incident it carries, each with its own sources, severity, confidence grade and disputed flag, alongside this one. This article is about a single record in that set, and the record is where the full field-by-field classification lives.

This is one record, researched and reported by others and cited here to them. Loom's own layer — identities, tool-server registrations and the IAM policies that decide what agents may touch — is the layer the sibling entries in the AI incident archive also reach, and each of those records carries its own sources, severity, confidence grade and disputed flag.