CVE-2026-103958

{
  "etk_id": "ETK-2026-391",
  "cve_id": "CVE-2026-103958",
  "display_id": "CVE-2026-103958",
  "ghsa_id": "GHSA-w6g6-h8pv-6mc7",
  "euvd_id": "EUVD-2026-91773",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Loom for AWS",
  "summary": "Loom for AWS versions before 1.7.0 are affected by server-side request forgery in tool server and remote agent connection handling. An authenticated remote user able to provide connection addresses during tool server or remote agent registration, updates, or testing may obtain container-role credentials or access responses from internal network services.",
  "mitigation": "Upgrade Loom for AWS to version 1.7.0 or later. Restrict access to tool server and remote agent registration, update, and testing functions until the upgrade is complete.",
  "vendor": "AWS",
  "product": "loom",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<1.7.0"
      ],
      "ecosystem": "loom for aws",
      "fixed_versions": [
        "1.7.0"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
  "epss_score": 0.0033,
  "epss_percentile": 0.2504,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.378529883333334,
  "t0_at": "2026-10-02T19:07:30.052000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T19:07:30.052000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T19:07:30.052000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103958"
    }
  }
}