AWS's Loom Agent Orchestration Platform Handed Full Admin to Any Network Client When No Identity Provider Was Set (CVE-2026-103956)

Loom for AWS, an AWS Labs open-source AI agent orchestration platform, and the Amazon SageMaker Distribution image used by SageMaker Unified Studio

AWS published two bulletins on October 2, 2026. In Loom, versions before 1.6.1 let any network client take full administrative control of the control plane when no identity provider was configured, including registering tool servers, reading stored credentials, and modifying IAM policies (CVE-2026-103956). Versions before 1.7.0 also let an authenticated user point a well-known OAuth2 discovery URL at an attacker endpoint to receive OAuth2 client secrets or access tokens (CVE-2026-103957), and direct connection requests at arbitrary internal addresses, including credential endpoints, and read the responses (CVE-2026-103958). A separate command injection in the SageMaker Distribution startup script allowed code execution in another project member's Space (CVE-2026-104019). AWS advised upgrading Loom to 1.7.0, rotating OAuth2 secrets and IAM session credentials, and reviewing CloudTrail

An authentication layer that fails open when left unconfigured, on the component that brokers every tool and credential the agents use, plus discovery and connection URLs taken from users without validation