A GitHub security advisory in AWS Labs' Loom repository, published 2026-10-02, reports that in Loom, an open-source platform for building, deploying and managing AI agents, the backend treated every request as a super-administrator when no identity provider was configured, including requests with no credentials. The advisory rates it Critical, CVSS 10.0, and says it affects versions before 1.6.1, fixed in 1.6.1, released 2026-08-04. It says a network client that could reach the backend could read, change or delete managed resources, including agents, memories, authorizer configuration and credentials, and invoke any agent.
It shows an agent control plane that could be fully open by default before identity setup was finished, so a missing authentication check exposed agents, their memory and their credentials.
Key facts
As stated in the sources, with where to find them.
- CVE-2026-103956, advisory GHSA-vgmj-998f-r8mp, published 2026-10-02, severity Critical. CVSS 10.0 (overall score), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory lists no CWE.Advisory header; Severity; CVE ID; Weaknesses
- Affected versions: before 1.6.1. Patched version: 1.6.1, which the advisory says was released on 2026-08-04, two months before the advisory's publication.Affected versions; Patched versions; Patches
- Per the advisory, the condition is that no Amazon Cognito user pool and no active external identity provider is configured, which it says is the state of a freshly deployed instance before identity setup is complete, or of one whose identity configuration becomes unreachable or is left unset.Impact
- Per the advisory, the fix requires an explicit opt-in for unauthenticated local development and limits the bypass to requests from the loopback interface, so a deployment without an identity provider is not reachable as an open admin panel over the network even if the opt-in is left set.Patches
- Workaround stated before upgrading: configure an identity provider before exposing the backend beyond loopback, confirm the local-development opt-in is unset in deployed environments, and restrict network access; the advisory says network restriction reduces but does not fully close the issue without upgrading.Workarounds
- The advisory credits Kenneth Cox for coordinated vulnerability disclosure. It says nothing about exploitation in the wild, and it does not mention an AWS Security Bulletin; no bulletin was read for this record.Description; Whole advisory
Findings that cite this record
No tracked finding cites this record yet.