Everything RedTeam Monitor has reported about AWS: 7 stories, newest first. Part of our Vulnerabilities coverage.
A flaw in AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10 let repository pushers access external resources in the same account.
Two vulnerabilities in the embedded network stack allow remote manipulation of IPv6 routing and DNS resolution, enabling traffic interception on affected devices.
Attackers can crash Rust-based AWS SDK servers by sending small, deeply nested data requests that exhaust stack space without needing credentials.
A flaw in the AWS HealthLake MCP server lets remote users with valid logins trick the system into sending temporary security keys to attacker-controlled servers.
A server-side request forgery in an AI agent tool allowed attackers to steal operator credentials via crafted prompts.
Amazon Web Services released security updates for Amazon Linux to fix the Dirty Frag privilege escalation bug and other kernel issues in 2026.
A CVSS 8.5 flaw in the databases-on-aws plugin allowed attackers to run OS commands. Version 1.7.1 resolves the issue.