All vulnerabilities
CVE-2026-103956GHSA-vgmj-998f-r8mp

Missing authentication for critical function in Loom for AWS

AWS loomContainers & cloud
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)1.70%Chance of exploitation activity in the next 30 days, higher than 76% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.6.1Fixed versionCVE List
Published2 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Public exploit code and templates 1

  • Scanner templateLoom for AWS < 1.6.1 - Unauthenticated Super-Admin AccessNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.

To remediate this issue, users should upgrade to version 1.6.1 or later.

Text from CVE List

Affected versions 1

  • loomaffected: all versions before 1.6.1CVE List

References 3