Admin by Default: AWS October Bulletins Fix Loom Control-Plane Takeover (CVE-2026-103956, CVSS 10.0) and SageMaker Cross-Space Execution (CVE-2026-104019)

2026-10-03 AI Vulnerabilities & CVEs by al-ice.ai Editorial

AWS published two security bulletins on 2 October 2026, both rated Important, covering four CVEs across two products that sit underneath AI agent work: Loom for AWS, the AWS Labs open-source platform for orchestrating AI agents, and Amazon SageMaker Unified Studio. Three flaws hit Loom — an authentication bypass, an OAuth2 token-disclosure bug, and a server-side request forgery — and the fourth is an OS command injection in SageMaker Space startup scripts. Neither bulletin reports exploitation in the wild or a public proof of concept, and those limits matter: this is a patch-and-rotate week, not an incident-response week. The reason it leads the site today is architectural. Loom controls agents, their tool servers, and their IAM roles, so a takeover there reaches far beyond one application — and the worst of the four bugs was fixed two months before AWS told anyone.

The worst bug is the oldest fix

CVE-2026-103956 is a missing-authentication flaw in Loom's authentication dependency, classified under CWE-306 (missing authentication for critical function) and CWE-1188 (insecure default initialization of resource permissions), carrying a CVSS 4.0 score of 10.0. It affects Loom versions before 1.6.1, and only deployments with no identity provider configured — but in that setup, AWS says any network client could obtain full administrative authority over the agent control plane. That includes registering malicious tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles.

Note the shape: the attacker needs no account, no scope, no invitation. The prerequisite is a deployment choice — exposing Loom beyond loopback without a Cognito user pool or external identity provider, with LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV left enabled in production. This site keeps meeting that shape. Last month's Bifrost AI gateway flaw was an unauthenticated RCE behind an insecure admin default, and the Azure AI Foundry missing-auth bug the same month. Agent infrastructure keeps shipping with the front door's lock sold separately, and operators keep mounting it on the network before buying the lock.

The timeline sharpens the point. AWS fixed CVE-2026-103956 in Loom 1.6.1 — GBHackers dates that release to 4 August 2026 — but the bulletin naming it arrived on 2 October, roughly two months later. That is the same disclosure-lag pattern this site documented yesterday in the AWS security-agent-mcp-server argument injection, where the fix shipped in August and the CVE in October. Defenders who keyed on advisories spent August and September exposed to a CVSS-10 admin bypass with a patch already available; defenders who track version drift were safe without ever knowing why. AWS's own advice concedes the point sideways: customers are told to move straight to 1.7.0, not merely to the 1.6.1 that fixed the headline bug, because the other two Loom flaws survived it.

Two scopes, two token paths

CVE-2026-103957 and CVE-2026-103958 both affect Loom releases before 1.7.0 and both require an authenticated user holding the mcp:write or a2a:write scope — a narrower actor than the network-everyone of the first bug, but a scope handed out routinely to anyone allowed to wire tools into agents. CVE-2026-103957 abuses OAuth2 discovery handling: a malicious well-known discovery URL causes the Loom backend to send OAuth2 client secrets or another user's access token to an attacker-controlled endpoint. AWS's 1.6.1 release blocked internal-address access through this path but did not fully eliminate the token disclosure; 1.7.0 does. CVE-2026-103958 is the blunter instrument: an SSRF-style flaw in the MCP tool-server and Agent2Agent remote-agent connection logic lets the scoped user force the platform to connect to arbitrary internal destinations and return the responses — including, per the bulletins, a container credential-vending endpoint, which converts directly into temporary AWS credentials spendable against whatever the associated IAM role can reach.

The OAuth2-discovery variant is worth pausing on because it is the second token-theft-through-MCP-plumbing bug in a month. September brought the Cycode finding against the MCP Python SDK's OAuth flow; now the same class appears server-side, in the orchestrator rather than the client. Discovery URLs, metadata endpoints, redirect targets — anywhere an agent platform fetches a URL on a user's behalf during authentication is a token-exfiltration surface until proven otherwise. And the logging caveat from the bulletins deserves attention: attacker activity conducted through the control plane or a scoped tool connection looks like legitimate application behaviour, so post-upgrade review of CloudTrail is not optional hygiene, it is the only retrospective signal available.

The SageMaker flaw crosses a boundary between people

CVE-2026-104019 is an OS command injection in the Space startup scripts used by SageMaker Unified Studio, stemming from improper sanitization of connection details during startup validation. A project member can craft connection information that executes arbitrary code inside another member's Space — a lateral move across a boundary users reasonably assume the platform enforces. Where Trusted Identity Propagation is enabled, the impact climbs: a contributor-level user can obtain another member's temporary execution-role credentials and invoke downstream AWS services on that user's behalf.

The remediation surface is unusually broad. Fixes ship in SageMaker Distribution versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5 and 4.4.3; version 4.5.x is not affected. Branches 2.8 through 2.13 and 3.3 through 3.8 have reached end of support and, per SecurityOnline's bulletin summary, receive no fix — upgrade is the only path there. AWS deployed corrected images globally, so for supported branches the action is restarting affected Studio Spaces rather than patching anything locally. That deployment model is convenient right up until it isn't: a centrally fixed image still leaves every Space that nobody restarts running the vulnerable startup path.

What to do

Upgrade Loom for AWS to 1.7.0 now, including forks and derivative deployments. 1.6.1 fixed only the headline auth bypass; the token-disclosure and SSRF flaws need 1.7.0. Confirm the running deployment, not just the pinned source — a compose file or image tag can hold you behind.
Require an identity provider before Loom touches a network. Configure a Cognito user pool or external IdP before exposing Loom beyond loopback, and verify LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset in every production environment. Treat any Loom reachable without login as already compromised for triage purposes.
Restrict mcp:write and a2a:write to trusted administrators. Both surviving Loom flaws are gated on these scopes. Anyone holding them can currently convert tool wiring into token theft or credential-endpoint access on unpatched deployments.
Rotate after upgrading, then look backwards. Rotate OAuth2 client secrets, revoke and reissue tokens active during the exposure window, rotate potentially exposed IAM session credentials, and review CloudTrail for control-plane and credential-vending anomalies. The bulletins report no exploitation, but absence of a report is not evidence of absence on infrastructure whose malicious use looks legitimate.
Restart SageMaker Studio Spaces; inventory the end-of-support branches. Supported Distribution lines pick up the fix on restart. Spaces on 2.8–2.13 or 3.3–3.8 have no fix coming — find them now and plan the upgrade, because the vulnerable startup script runs before any of your code does.

Our verification was documentary and primary-source-led. We read three independent secondary reports of the 2 October bulletins in full (fix versions, scope preconditions, CWE classifications, rotation guidance and the August-to-October disclosure lag), cross-checked the four CVE identifiers and their mechanics against CVE-record aggregators, and attributed the CVSS 4.0 figures (10.0, 9.3, 8.3, 8.2) to the bulletin summary that published them rather than asserting them as our own measurement. We did not deploy Loom or SageMaker Unified Studio, reproduce any of the four flaws, or contact any third-party system.

Sources: