CVE-2026-5708 - Vulnerability Analysis

Overview

AWS Research and Engineering Studio (RES) < 2026.03 contains a broken access control vulnerability caused by unsanitized user-modifiable attributes in session creation, letting authenticated remote users escalate privileges and assume instance profile permissions, exploit requires authentication.

Severity & Score

Impact

Authenticated users can escalate privileges and assume instance profile permissions to interact with AWS resources.

Mitigation

Upgrade to RES version 2026.03 or apply the corresponding mitigation patch.

References

• https://aws.amazon.com/security/security-bulletins/2026-014-aws/
• https://github.com/aws/res/issues/149
• https://github.com/aws/res/releases/tag/2026.03

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner