CVE-2026-103956

AWS Loom AI Agent Platform Flaw Handed Unauthenticated Attackers Super-Admin Control Over Agents, Credentials and IAM Policies

CVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.