CVE-2026-103958: Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent.
To remediate this issue, users should upgrade to version 1.7.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Loom for AWSto a version that resolves this vulnerability.Fixed in 1.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user who can supply a connection address while registering, updating, or testing a tool server or remote agent can exploit it.
What could an attacker access through successful exploitation?
An attacker might obtain the credentials associated with the application's own container role and read responses from arbitrary internal network locations.
Which workflows should be reviewed for exposure?
Review tool server and remote agent registration, update, and connection-testing workflows, because each can accept the crafted connection address used for exploitation.
What is the remediation?
Upgrade Loom for AWS to version 1.7.0 or later.