GHSA-f6f6-6f88-r57j: Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
Published Oct 30, 2026
·Updated
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint.
To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Event History
Oct 30, 2026
CVE Published
via OSV·04:12 PM
Data Sourced
via OSV·04:12 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments need remediation?
Custom enclave images built with aws-nitro-enclaves-sdk-c versions before 0.4.6 need remediation. Rebuild those images against version 0.4.6.
2
What access does an attacker need to exploit this issue?
The supplied severity vector indicates an attacker needs local access and low privileges. No user interaction is required.
3
What is the security impact if exploitation succeeds?
A third party may impersonate the enclave's AWS KMS endpoint. The severity vector indicates high impact to integrity in both the vulnerable component and subsequent components, with no indicated confidentiality or availability impact.