Version 1.7.1 patches CVSS 8.5 unauthenticated OS command execution flaw CVE-2026-107322 in databases-on-aws

Amazon has released a security update for its databases-on-aws plugin to address a high-severity vulnerability that could allow attackers to execute arbitrary commands on a host system. The fix is available in version 1.7.1, which resolves an OS command injection flaw identified as CVE-2026-107322.

In plain English

This vulnerability stems from incomplete input validation within the Amazon Agent Plugins. Specifically, the software failed to properly restrict certain types of data entered into the system. Because the list of disallowed inputs was not comprehensive, a remote attacker who did not need to log in could craft a malicious database command. When this crafted value was processed in the agent context, it triggered the execution of operating system commands on the server running the helper service.

Essentially, the application trusted user input too much. By injecting specific code into a database command field, an attacker could trick the system into running instructions on the underlying server. This bypassed normal authentication requirements, granting the attacker direct control over the host environment.

The background

The issue was tracked under CVE-2026-107322 and assigned a CVSS score of 8.5, which the National Vulnerability Database categorizes as high severity. The weakness aligns with CWE-184, which refers to improper control of generated code for a dynamically-modifiable language. This classification highlights that the software generated or executed code based on external input without sufficient safeguards.

According to AWS Security Bulletins, the flaw affected all versions of the databases-on-aws plugin prior to 1.7.1. The advisory notes that the vulnerability existed because the plugin did not maintain a complete list of prohibited inputs. This gap allowed malicious payloads to slip through standard checks and reach the command execution layer.

What changes now

To resolve this issue, users are advised to upgrade their databases-on-aws plugin to version 1.7.1 or a later release. The advisory explicitly states that users must verify the updated plugin is active in every environment where it is deployed. Merely installing the update is insufficient if the system continues to run the older, vulnerable version.

Security teams should audit their agent configurations to ensure the patched version is operational. This verification step is critical because automated updates may not always apply to all instances, particularly in complex or isolated network segments. Confirming the active version prevents exposure to the unauthenticated remote code execution risk.

What to do and how to stay safe: AWS

• Check all servers running the databases-on-aws plugin to identify the current version number.
• Upgrade any instances running versions prior to 1.7.1 to the latest available release.
• Verify that the updated plugin is actively serving requests in each environment.
• Monitor system logs for any signs of unauthorized command execution or unusual database activity.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability considered critical?

No, it is rated high severity with a CVSS score of 8.5, not critical.

Do I need to be logged in to exploit this flaw?

No, the vulnerability allows for unauthenticated remote access.

What version fixes the issue?

Version 1.7.1 and later versions resolve the vulnerability.