Vulnerabilities

OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated…

OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement. To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

AWS

Product

trusted-remote-execution

CVSS v3.1

9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness

CWE-78

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-122193 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 40
   AWS bulletin AWS 4h ago

   CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)

   CVE-2026-122193 Amazon Web Services