AWS Serverless MCP Server versions below v0.2.1 have a path traversal flaw (CVE-2026-116635) in the deployment status component. An attacker who can influence the MCP agent could read or modify JSON files outside the intended directory. If you're running this tool, update immediately to v0.2.1 or later.
source: [aws/security-bulletin]
Virtual Engineering Workbench (VEW) has a nasty template injection vulnerability (CVE-2026-119085) in its publishing component that lets authenticated attackers execute arbitrary code with Lambda IAM permissions. All versions before commit c146486 are affected—if you're running VEW, update immediately. This one's serious and requires action.
source: [aws/security-bulletin]
Apache Iceberg in awswrangler versions 3.5.2 through 3.17.1 has a critical SQL injection flaw in identifier quoting. An authenticated user with Glue Data Catalog permissions could exploit this to read restricted tables or modify privileged data via crafted column names. Update to version 3.17.1 or later immediately if you're using affected versions.
source: [aws/security-bulletin]
CVE-2026-98432 is a nasty use-after-free bug in the Linux kernel's IPv4 TCP handshake that could lead to remote code execution on versions 4.4+. If you're running self-managed Amazon Linux 2 or 2023 instances, you'll need to update your kernel packages and reboot—no way around it. AWS is handling updates for managed services automatically, so those users can relax. Check the full bulletin for per-service details and patch availability.
source: [aws/security-bulletin]
Amazon Kinesis Producer Library for Java versions before 1.0.8 expose AWS credentials through debug logs and process arguments, allowing local users to steal credentials. Affected versions: com.amazonaws:amazon-kinesis-producer ≤ 0.15.12 and software.amazon.kinesis:amazon-kinesis-producer < 1.0.8. Action required: upgrade immediately if you're running these versions, especially if DEBUG logging is enabled.
source: [aws/security-bulletin]
AWS Nitro Enclaves SDK for C versions up to v0.4.5 have two nasty security issues. CVE-2026-119116 is a use-after-free bug in kmstool-enclave that lets local attackers execute arbitrary code inside the enclave via crafted vsock messages. CVE-2026-119148 is an input validation flaw allowing attackers to impersonate AWS KMS and inject fake key material. If you're running affected versions, update immediately—this one requires action.
source: [aws/security-bulletin]
FreeRTOS-Kernel versions 7.4.0 through 11.3.2 have a nasty type validation bug (CVE-2026-119086) in the xQueueSelectFromSet function. If you're running MPU-enabled builds with queue sets enabled, unprivileged tasks could exploit this to write memory in privileged context—yikes for security. Only affected if you use queue sets; standard builds are safe. Update immediately if you match these specs.
source: [aws/security-bulletin]