AWS patches three Loom for AWS control-plane flaws

AWS Security Bulletin 2026-124, published October 2, describes three vulnerabilities in Loom for AWS and recommends version 1.7.0, including for forks and derivatives. Loom is an AWS Labs open-source agent platform; its product overview describes centralized management of agents and their integrations.

Three paths through the control plane

CVE-2026-103956 affected versions before 1.6.1. When no identity provider was configured, an unauthenticated network client could gain administrator control of the agent control plane. AWS fixed this issue in 1.6.1, released August 4.

CVE-2026-103957 affected versions before 1.7.0. An authenticated user with mcp:write or a2a:write could configure OAuth discovery so the backend sent client secrets or another user’s access token to an outside endpoint. Version 1.6.1 blocked internal-address reach on this path; AWS says 1.7.0 completed the fix.

CVE-2026-103958 also affected versions before 1.7.0. Users with those scopes could direct MCP or A2A connection requests to internal services and read responses, including from the container credential endpoint.

Separate identity, authority, and reach

The flaws touch three different controls: identity determines who can enter, scopes determine who can change integrations, and outbound policy limits which services those integrations can reach. Each boundary needs its own test. An account that can manage agent connections exercises meaningful authority even when it never runs agent code itself.

The practical lesson is to review the orchestration plane as a production control system. Check which principals can register tools or agents, how integration credentials are scoped, and which network destinations the backend can reach. Keep that review separate from model behavior: prompt constraints do not govern credentials or server-side requests. This is an architectural implication of the affected components, not a claim that every deployment shares the same exposure.

AWS recommends upgrading to 1.7.0 and patching forks or derivative builds. Rotate OAuth client secrets and revoke and reissue access tokens that were active during the affected period. If container role credentials were accessed, rotate the IAM session credentials and review CloudTrail. The bulletin does not report in-the-wild exploitation.