AWS patches a critical hole (10 out of 10 severity) in Loom, its SI agent management platform
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Infrastructure for SI agents is maturing along with them: holes are being found and closed before agents become ubiquitous.
Vulnerability CVE-2026-103956 in the open Loom platform allowed obtaining superadministrator rights without authentication if no login provider was connected. Two more Loom vulnerabilities (CVE-2026-103957 and 103958) concern leaks of AWS tokens and temporary keys, and a fourth is command injection in SageMaker (CVE-2026-104019). The fix: update to Loom 1.7.0 and rotate OAuth2 secrets.
Sources 1