CVE intelligence

CVE-2026-103956

Vulnerability intelligence

Published Oct 2, 2026Sources checked Oct 2, 2026

10.0CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-103956 and is rated Critical severity with a CVSS score of 10.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

AWS Security Bulletins guidance

We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes.

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-103956?

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.