Why these issues matter
AI agents can connect business systems, use tools, and act with delegated permissions. That makes the security of an agent platform depend on more than its model: identity, integrations, credentials, and cloud permissions all matter.
On October 2, 2026, Amazon Web Services (AWS) published Security Bulletin 2026-124-AWS, detailing three security vulnerabilities in Loom for AWS, an open-source AI agent orchestration platform developed by AWS Labs. The CVSS 10.0 (Critical) rating applies specifically to CVE-2026-103956.
The practical takeaway is straightforward: organizations using Loom for AWS should upgrade to version 1.7.0 or later, then review credentials and activity that may have been exposed. AWS addressed CVE-2026-103956 in version 1.6.1; version 1.7.0 addressed CVE-2026-103957 and CVE-2026-103958. Ensure any forked or derivative implementations include all three fixes.
The three issues affect different parts of the platform:
- CVE-2026-103956: An authentication bypass that could allow unauthenticated network clients to gain administrative control over the agent control plane in deployments without a configured identity provider. The CVE record rates this vulnerability CVSS 10.0 (Critical).
- CVE-2026-103957: An OAuth2 credential and access-token disclosure vulnerability involving outbound requests during OAuth2 discovery.
- CVE-2026-103958: A server-side request forgery (SSRF) vulnerability in MCP tool-server and A2A remote-agent connection handling.
Depending on the deployment and permissions involved, the consequences could extend beyond Loom itself to integration credentials, access tokens, internal services, and cloud workload credentials.
This article explains the conditions behind each issue, what could be at risk, and the steps organizations can take to reduce exposure.
How the vulnerabilities could be exploited
CVE-2026-103956: Authentication bypass
In Loom versions earlier than 1.6.1, a network-reachable deployment without a configured identity provider could allow an unauthenticated attacker to obtain administrative control of the agent control plane through requests to the application API.
Potential attack path:
- Access the exposed application API without proper authentication.
- Register unauthorized tool servers or access stored integration credentials.
- Modify IAM role policies attached to managed agent roles.
Potential impact: Unauthorized control of AI agent integrations, credential exposure, and increased cloud privileges.
Security focus: Identity-provider configuration, API authentication, and IAM privilege boundaries.
CVE-2026-103957: OAuth2 token and secret disclosure
In Loom versions earlier than 1.7.0, an authenticated user with the mcp:write or a2a:write scope could configure an OAuth2 discovery URL whose returned document directs the backend to send OAuth2 client secrets or another user’s access token to a third-party-controlled endpoint.
Potential attack path:
- Abuse integration configuration permissions.
- Influence the OAuth2 discovery response.
- Cause the backend to disclose client secrets or another user’s access token to an external destination.
Potential impact: Compromised integrations, unauthorized access to connected services, and potential account or data exposure.
Security focus: OAuth2/OIDC discovery, token handling, and destination validation.
CVE-2026-103958: SSRF and access to internal services
In Loom versions earlier than 1.7.0, an authenticated user with the mcp:write or a2a:write scope could supply a crafted connection address when registering, updating, or testing a tool server or remote agent. This could cause Loom to send requests to internal network locations, including the application container’s credential endpoint, and read the responses.
Potential attack path:
- Abuse tool-server or remote-agent connection configuration.
- Direct backend requests toward internal services.
- Read responses from reachable endpoints, potentially including workload credential services.
Potential impact: Internal service exposure, sensitive information disclosure, and potential access to workload credentials.
Security focus: URL validation, outbound network controls, and workload credential endpoint protection.
Affected issues and fixed versions
Use this summary to compare the three issues. CVSS values and severity labels are retained from the supplied draft.
What these issues mean for organizations
Together, the vulnerabilities show how identity and integration controls can shape the impact of an AI agent compromise.
- Identity and administrative control: Authentication failures can expose agent control planes and connected integrations to unauthorized access.
- Integration credential exposure: Leaked OAuth2 secrets or access tokens can compromise connected business applications.
- Internal service access: SSRF vulnerabilities may allow attackers to reach internal services that are not directly exposed to the internet.
- Excessive cloud permissions: Compromised agents or workload credentials may expose cloud resources if IAM permissions are overly broad.
Organizations should enforce strong authentication, secure credential handling, restrict network access, apply least-privilege IAM policies, and monitor suspicious activity. These risks represent potential impacts, not proof of an actual compromise.
What organizations should do now
Prioritize these actions if your organization uses Loom for AWS:
- Upgrade Loom: Upgrade to the latest available release that incorporates all three fixes. At minimum, version 1.7.0 addresses CVE-2026-103957 and CVE-2026-103958, while version 1.6.1 addresses CVE-2026-103956. Ensure maintained forks and derivative implementations include the fixes.
- Secure authentication: Until upgrading, ensure that an Amazon Cognito user pool or an active external identity provider is fully configured before the backend is reachable beyond loopback. Confirm that LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset in deployed, non-development environments.
- Restrict privileged scopes: Until upgrading, limit mcp:write and a2a:write permissions to trusted administrators. This reduces exposure but does not replace the code fixes.
- Rotate credentials and tokens: After upgrading, rotate OAuth2 client secrets used by MCP/A2A integrations and revoke and reissue access tokens that were active during the affected period. If container-role credentials may have been accessed, rotate the relevant IAM role session credentials.
- Review and validate: Review AWS CloudTrail and application logs for suspicious IAM policy changes, unauthorized tool-server registrations, unexpected credential use, and unusual outbound requests. Verify the fixes in production and retest the relevant security controls.
How CLEAR INFOSEC can help
A focused security assessment can help teams identify exposed Loom deployments, evaluate related controls, and prioritize remediation. The engagement can follow five steps:
Context and scoping
Align stakeholders and testing assumptions; define objectives, scope, success criteria, rules of engagement and constraints.
Output: Approved scope and engagement plan.
Locate and enumerate
Build the asset and attack-surface inventory across AI agent and AWS assets, configurations, integrations, identities, services, technologies and permissions.
Output: Asset inventory and exposure map.
Exploit and evaluate
Validate vulnerabilities through controlled testing; confirm exploitability and business relevance, capture evidence, and maintain safe execution.
Output: Validated findings and proof of impact.
Analyze and advise
Analyze root causes, risk, and attack paths; prioritize findings by severity and business impact; provide practical remediation guidance.
Output: Risk analysis and prioritized recommendations.
Retest and report
Verify remediation through retesting; confirm closure and residual risk status; deliver final evidence, summary, and executive reporting.
Output: Retest results and final report.
Continuous testing cycle: Assess → Remediate → Retest → Reassess
Conclusion: secure the connections behind AI agents
CVE-2026-103956, CVE-2026-103957 and CVE-2026-103958 show that AI agent security extends beyond model safety. Authentication, tool registration, OAuth2 integrations, outbound requests and cloud execution permissions all form part of the security boundary.
For organizations using Loom for AWS, upgrading to a fixed release is the primary remediation. A structured security assessment can complement that work by identifying exposed deployments, validating access controls, evaluating potential credential exposure and confirming that remediation is effective.
At CLEAR INFOSEC, we help organizations assess cloud environments, test application security controls and strengthen the protection of AI-enabled infrastructure.
Sources and further reading
- AWS Security Bulletin 2026-124-AWS: Loom for AWS vulnerabilities
- CVE-2026-103956: NIST National Vulnerability Database
- CVE-2026-103957: CVE.org
- CVE-2026-103958: CVE.org
- Loom for AWS v1.7.0 release notes