CVE-2026-124501: Tidelift moto AWS Batch Emulation models.py privileges management
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected package is pypi/moto through version 5.2.4, specifically its AWS Batch emulation component in moto/batch/models.py. The available data does not identify configuration-specific conditions or a fixed version.
What does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction, according to the supplied vector. Exploitation involves manipulation of the privileged and volumes arguments.
Is public exploit code available?
Yes. The report states that an exploit has been made public and may be used in attacks.
What is the impact of successful exploitation?
Successful exploitation may affect confidentiality, integrity, and availability at low impact levels. The underlying weakness is improper privilege management in AWS Batch emulation.