CVE-2026-6912: AWS Ops Wheel, друго

Описание

Оригинално описание

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Засегнати продукти

• AWS AWS Ops Wheel: преди 164

Вид слабост

• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

История

Други уязвимости в AWS AWS Ops Wheel

• 7.3CVE-2026-18481
• 9.8CVE-2026-6911

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-6912
• https://nvd.nist.gov/vuln/detail/CVE-2026-6912
• https://github.com/aws/aws-ops-wheel/pull/165
• https://aws.amazon.com/security/security-bulletins/2026-018-aws/
• https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-qvfh-9cjw-8wwq