aws_exposable_resources

AWS 可公开暴露的资源 本仓库的目标是维护一份所有可以公开暴露的 AWS 资源列表，并最终收录那些可以与不受信任的账户共享的资源（该部分仍在开发中，尚未包含在此处）。 以下概念适用于本列表： 通过其他资源间接暴露的资源不在收录范围内。例如，CloudTrail 日志可以被发送到一个公开的 S3 存储桶，但这是 S3 存储桶配置错误导致的，因此 CloudTrail 不会被视为可公开的资源。 某些资源可能需要同时配置多个条件才能被视为公开。例如，一个用 KMS 加密的 Secrets Manager 密钥，需要同时公开密钥策略和 KMS...

CVE-2026-43867

camel-pqc AWS Secrets Manager 密钥元数据不安全反序列化复现工具（CVE-2026-43867） 本项目演示了 Apache Camel 的 camel-pqc 组件中的一个 Java 反序列化漏洞 ，编号为 CVE-2026-43867 。AwsSecretsManagerKeyLifecycleManager.deserializeMetadata 从 AWS Secrets Manager 的密钥中读取持久化的后量子密钥元数据，其流程是对存储的值进行 Base64 解码，然后使用原始的 java.io.ObjectInputStream.readObje...

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

With artificial intelligence AI shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by...

CVE-2026-75910

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

EUVD-2026-63585

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910

The ClickHouse connector deployment template in Amazon Athena Federated Query (versions before v2026.17.1) has an incorrect privilege assignment: an authenticated remote user can point the connector's connection string at an unrelated AWS Secrets Manager secret and a database endpoint they contro...

CVE-2026-75910: Incorrect Privilege Assignment

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

PT-2026-79118

Name of the Vulnerable Software and Affected Versions Amazon Athena Federated Query ClickHouse connector versions prior to v2026.17.1 Description Incorrect privilege assignment in the deployment template allows an authenticated remote user to read arbitrary AWS Secrets Manager secrets within the...

Deserialization Of Untrusted Data

Apache Camel PQC Component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to AwsSecretsManagerKeyLifecycleManager.deserializeMetadata deserializing attacker-controlled data with ObjectInputStream.readObject without an ObjectInputFilter or class allow-list, allowing a...

Secrets Disclosure

Apache Airflow is vulnerable to Secrets Disclosure. The vulnerability is due to the AWS Systems Manager Parameter Store and Secrets Manager backends resolving a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed, where a caller in one team...

PYSEC-2026-3713

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

PYSEC-2026-3713

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

EUVD-2026-55701

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

CVE-2026-68872 Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...