CVE-2026-107322: aws databases-on-aws, логическа грешка

Описание

Оригинално описание

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.

Засегнати продукти

• aws databases-on-aws: преди 1.7.1

Вид слабост

• CWE-184 Непълен списък със забранени входове

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-107322
• https://nvd.nist.gov/vuln/detail/CVE-2026-107322
• https://github.com/awslabs/agent-plugins/commit/8b13a503746a4ebb0402b936645163224058bde3
• https://github.com/awslabs/agent-plugins/pull/232
• https://aws.amazon.com/security/security-bulletins/2026-130-aws/