intelligence_src_b35573840dfc5ce6da
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Oct 08, 2026 19:29 UTC
- Retrieved
- Oct 14, 2026 14:33 UTC
CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws
Bulletin ID: 2026-130-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 11:30 AM PDT Description: Amazon Agent Plugins for AWS is an open source collection of plugins that extends supported AI coding agents with AWS-focused workflows and tool integrations. The databases-on-aws plugin provides database design, development, migration, and operational guidance, including Aurora DSQL helper scripts. We identified CVE-2026-107322, where an incomplete list of disallowed inputs in databases-on-aws versions before 1.7.1 could allow a remote unauthenticated actor to supply crafted content that an agent ingests. The affected code is not a listening network service; operating-system command execution on the host is possible only if the agent subsequently invokes the local helper with the crafted database command value. Any resulting command runs with the permissions of the process running the helper. This issue does not affect the Aurora DSQL service or bypass database privileges. Impacted versions: databases-on-aws versions 1.0.0 through 1.7.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Reference details
- Source category
- research-report
- First reported
- Oct 08, 2026 19:29 UTC
- Last reported
- Oct 08, 2026 19:29 UTC
- Catalog updated
- Oct 14, 2026 14:33 UTC
- Record ID
2a431e6975a11f156a726ef04f947fab4547dbf08b15d79749e0bb2d66ed5823
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_b35573840dfc5ce6daRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.