Topic

Aws Loom

Coverage tagged aws loom.

Articles: 1
Desk: 1

Loom for AWS before 1.6.1 trusted any network client as super-admin when no identity provider was configured CVE-2026-103956 : unauthenticated client, backend with no IdP, fixed super-admin identity, agent control plane. Fixed in 1.6.1 and 1.7.0.

AWS fixes Loom flaw that gave any network client admin rights on deployments without an identity provider

AWS Loom before 1.6.1 treated every client as super-admin with no identity provider set (CVE-2026-103956). Upgrade to 1.7.4; 1.7.0 fixes two SSRF flaws.

Oct 5 · 6 min