An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context.



To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
aws databases-on-aws unaffected
Version Status Constraints
0 affected < 1.7.1

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Aws Subscribe
Databases-on-aws Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://aws.amazon.com/security/security-bulletins/2026-130-aws/ cve-icon cve-icon
https://github.com/awslabs/agent-plugins/commit/8b13a503746a4ebb0402b936645163224058bde3 cve-icon cve-icon
https://github.com/awslabs/agent-plugins/pull/232 cve-icon cve-icon
History

Thu, 08 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.
Title OS command injection in Amazon Agent Plugins for AWS databases-on-aws
First Time appeared Aws
Aws databases-on-aws
Weaknesses CWE-184
CPEs cpe:2.3:a:aws:databases-on-aws:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws databases-on-aws
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-08T19:19:24.257Z

Reserved: 2026-10-07T17:36:30.283Z

Link: CVE-2026-107322

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T19:16:59.857

Modified: 2026-10-08T20:17:31.590

Link: CVE-2026-107322

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses