Advisories

CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS

Bulletin ID: 2026-124-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/02/2026 12:00 PM PDT Description: Loom is an AWS Labs open-source AI agent orchestration platform. We have identified and addressed three issues in Loom for AWS, described below. We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes. - CVE-2026-103956 ‐ Authentication bypass in Loom for AWS (CWE-306, CWE-1188) An issue in the authentication dependency in Loom for AWS versions - CVE-2026-103957 ‐ OAuth2 token and credential disclosure via outbound request handling in Loom for AWS (CWE-918, CWE-201) An issue in

Read at AWS Security Bulletins

Vendor

Amazon Web Services

• AWS Security Bulletins (aws.amazon.com)
• CVE-2026-103956 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-103957 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-103958 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 29d ago

   Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote…

   CVSS 7.6 Fix available CVE-2026-103958
2. 8
   CVE NVD 29d ago

   Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the…

   CVSS 6.2 Fix available CVE-2026-103957
3. 23
   CVE NVD 29d ago

   Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain…

   CVSS 10.0 Fix available CVE-2026-103956