CVE-2026-119148: Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

Published Oct 30, 2026

Updated

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint.

To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

Event History

Oct 30, 2026

CVE Published

via MITRE·04:12 PM

Data Sourced

via MITRE·04:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Custom enclave images built against aws-nitro-enclaves-sdk-c versions before 0.4.6 are affected. The remediation specifically requires rebuilding those custom enclave images against version 0.4.6.

What does an attacker need to exploit this issue?

The issue involves an AWS Region value supplied by a parent being insufficiently validated. A third party may use this to impersonate the enclave's AWS KMS endpoint.

What should teams do if they use the affected SDK?

Rebuild custom enclave images using aws-nitro-enclaves-sdk-c 0.4.6. The provided information does not specify an alternative mitigation for images that cannot immediately be rebuilt.

CVE-2026-119148: Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What should teams do if they use the affected SDK?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What should teams do if they use the affected SDK?