CVE-2026-103956
Missing authentication for critical function in the authentication dependency in Loom for AWS…
- Risk score
- 80/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 1.7%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to mana…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.1 or later.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.
Last activity 2 Oct 2026. Patch Forecast updates every hour.