interesting · Privilege — edge

Public code shows that Loom for AWS can make every network client a super-admin when no identity provider is active.

Affects

Loom for AWS, AWS Labs' self-hosted AI-agent orchestration and management platform.

Before version 1.6.1, the authentication dependency returns a fixed super-admin identity without examining an Authorization header when neither Cognito nor an active external provider is configured.

Detail and 4 sources

That identity can control agents and security configuration, invoke agents, register tool servers, export stored integration secrets, and rewrite managed-agent IAM role policies. Public testing reproduced identity acquisition, resource creation, and secret export.

Sources

Code / PoCMissing authentication for critical function in Loom for AWS · Advisory · awslabs/loom · GitHub Code / PoCRelease v1.6.1 · awslabs/loom · GitHub Code / PoCGitHub - abraxas/cve-2026-103956-loom-unauth: CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured · GitHub VendorCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS

Copy link

Share this finding

Email Hacker News Reddit Mastodon Bluesky X LinkedIn Facebook Copy link