Loom for AWS < 1.6.1 - Unauthenticated Super-Admin Access

Loom for AWS 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured. id: CVE-2026-103956 info...

CVE-2024-23742

CVE-2024-23742 An issue in Loom through 0.196.1 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. With this tool, we can check if the App is Vulnerable: After validation, we can inject our code, and get a shell Enjoy Your She...

cve-2026-103956-loom-unauth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-103956-loom-unauth Write-up: https://abraxaslabs.tech/research/cve-2026-103956-loom-unauth cve-2026-103956-loom-unauth Loom for AWS 1.6.1 - AWS Labs When Cognito is unset and no external IdP is active,...

AWS Loom CVE-2026-103956 unauthenticated super-admin

CVE-2026-103956 Loom for AWS 1.6.1: when Cognito / external IdP is unset, getcurrentuser grants t-admin / g-admins-super without Authorization. Confirms via GET /api/auth/me and optional read-only MCP server listing. !/usr/bin/env python3 -- coding: utf-8 -- """AWS Loom for AWS unauthenticated...

loom-code (>=0.1.1, <=0.4.3), reposeed (>=0.4.0, <=0.14.0) potentially affected by unknown CVE via graphifyy (>=0.8.51, <=0.9.49)

graphifyy PYPI version =0.8.51, =0.1.1, =0.4.0, =0.14.0 Source cves: unknown CVE Source advisory: GHSA-PCC4-RVHR-2PR8...

loom-code (>=0.1.1, <=0.4.3), reposeed (>=0.4.0, <=0.14.0) potentially affected by unknown CVE via graphifyy (>=0.8.51, <=0.9.49)

graphifyy PYPI version =0.8.51, =0.1.1, =0.4.0, =0.14.0 Source cves: unknown CVE Source advisory: OSV:GHSA-PCC4-RVHR-2PR8...

loom-code (>=0.1.1, <=0.4.3), reposeed (>=0.4.0, <=0.14.0) potentially affected by unknown CVE via graphifyy (>=0.8.51, <=0.9.49)

graphifyy PYPI version =0.8.51, =0.1.1, =0.4.0, =0.14.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-GRAPHIFYY-21693746...

Exploit for CVE-2026-103956

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

EUVD-2026-91773

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

CVE-2026-103958

Loom for AWS versions before 1.7.0 are vulnerable to a Server-side request forgery (SSRF) in the tool server and remote agent connection handling. An authenticated remote user can exploit this by supplying a crafted connection address during the registration, updating, or testing of a tool server...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

EUVD-2026-91772

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...