AWS has released fixes for four security vulnerabilities affecting its open-source Loom AI agent orchestration platform and Amazon SageMaker Unified Studio.
The issues could enable authentication bypass, OAuth2 token theft, cloud credential exposure, internal network access, and arbitrary code execution in affected environments.
The advisories, published on October 2, 2026, cover three Loom for AWS vulnerabilities tracked as CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958, along with CVE-2026-104019, an OS command injection flaw in the SageMaker Distribution startup process.
AWS Fixes Critical Loom and SageMaker Flaws
The most severe Loom issue, CVE-2026-103956, is an authentication bypass affecting versions earlier than 1.6.1.
The flaw exists in Loom’s authentication dependency and can allow any network client to obtain full administrative control of the agent control plane when the deployment has no configured identity provider.
An attacker exploiting the issue could register malicious tool servers, access stored integration credentials, and modify IAM role policies attached to managed agent roles.
The vulnerability is classified under CWE-306, missing authentication for critical functions, and CWE-1188, insecure default initialization of resource permissions.
AWS fixed CVE-2026-103956 in Loom version 1.6.1, released on August 4, 2026. However, organizations should move directly to version 1.7.0, which also addresses the remaining two Loom flaws.
CVE-2026-103957 affects Loom versions earlier than 1.7.0 and involves unsafe OAuth2 discovery handling.
An authenticated user holding either the mcp:write or a2a:write scope could configure a malicious well-known discovery URL that causes the Loom backend to send OAuth2 client secrets or another user’s access token to an attacker-controlled endpoint.
AWS noted that the previous 1.6.1 update blocked access to internal addresses in this path but did not fully eliminate token disclosure. Version 1.7.0 fully addresses the issue.
The third issue, CVE-2026-103958, is an SSRF-style outbound request flaw in Loom’s Model Context Protocol tool server and Agent2Agent remote agent connection logic.
A user with mcp:write or a2a:write permissions could force the platform to connect to arbitrary internal network destinations and return their responses.
This could include access to a container credential-vending endpoint, potentially exposing temporary AWS credentials. Attackers could then abuse those credentials to access cloud resources within the affected role’s permissions.
AWS also patched CVE-2026-104019, an OS command injection vulnerability in SageMaker Space startup scripts used by Amazon SageMaker Unified Studio.
The flaw stems from improper sanitization of SageMaker connection details during startup validation. Under certain conditions, a project member could craft connection information that results in arbitrary code execution inside another member’s SageMaker Space.
In projects using Trusted Identity Propagation, successful exploitation could enable a contributor-level user to obtain another member’s temporary execution-role credentials and invoke downstream AWS services on that user’s behalf.
Organizations running Loom should upgrade to version 1.7.0 and patch any forks or derivative deployments.
Until patching is complete, AWS recommends requiring a Cognito user pool or active external identity provider before exposing Loom beyond loopback access, while ensuring LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is not set in production.
Access to the mcp:write and a2a:write scopes should be limited to trusted administrators. After upgrading, organizations should rotate OAuth2 client secrets, revoke and reissue access tokens active during the exposure window, rotate any potentially accessed IAM role session credentials, and review AWS CloudTrail logs for suspicious activity.
For SageMaker Distribution, AWS recommends restarting affected Studio Spaces to receive updated images. Supported fixes are available in versions 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, and 4.4.3, while version 4.5.x is not affected.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
