CVE-2026-103956: Missing authentication for critical function in Loom for AWS
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.
To remediate this issue, users should upgrade to version 1.6.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Loom for AWSto a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated takeover?
Loom for AWS deployments running versions before 1.6.1 are exposed when no identity provider is configured. In that configuration, a remote actor can use any request to the application API to obtain super-admin authority over the agent control plane.
What could an attacker do after exploiting this issue?
An attacker could register tool servers, read stored integration credentials, and rewrite IAM role policies attached to managed agent roles. The issue can therefore affect confidentiality, integrity, and availability of the managed environment.
Does exploitation require credentials, user interaction, or a complex attack path?
No. The issue is described as remotely exploitable through the application API with no privileges or user interaction required, provided the deployment has no identity provider configured.
What is the remediation?
Upgrade Loom for AWS to version 1.6.1 or later. The affected versions are those before 1.6.1.