What’s Vulnerable › Vulnerabilities

CVE-2026-6912: Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-10-26
• Weakness: CWE-915

Description

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

• AWS Ops Wheel: before 164 — fixed in 164

How to fix

Upgrade to a fixed version: AWS Ops Wheel 164. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-018-aws/
• https://github.com/aws/aws-ops-wheel/pull/165
• https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-qvfh-9cjw-8wwq

Get alerted when CVE-2026-6912 or the next vulnerability affects your stack