bartek@aws: ~/news
$ whoami

Bartek Chojnacki

$ AWS Architect · DevOps · Cloud
Wednesday, July 8, 2026
Tuesday, July 7, 2026

AWS Research and Engineering Studio: Critical Symlink Vulnerability Requires Immediate Update

AWS Research and Engineering Studio (RES) versions 2026.03 and earlier contain a nasty symlink resolution bug (CVE-2026-14904) in the Auth.GetUserPrivateKey API. An authenticated attacker can swap their SSH private key with a symbolic link to read arbitrary files on the cluster-manager instance—including other users' keys and secrets—since the process runs as root. Update to the latest version immediately if you're running RES.

source: [aws/security-bulletin]

Monday, July 6, 2026

Critical SQL Injection in AWS mcp-gateway-registry Metrics Service

AWS mcp-gateway-registry versions 1.0.3 through 1.0.12 have a nasty authenticated SQL injection vulnerability (CVE-2026-14471) in the metrics-service retention policy subsystem. An authenticated attacker can craft malicious table_name values to execute arbitrary SQL queries, potentially exposing API keys and modifying database contents. Action required: upgrade to a patched version immediately if you're running affected versions.

source: [aws/security-bulletin]