CVE-2026-6912 - Vulnerability Analysis

Overview

AWS Ops Wheel before PR #165 contains a broken access control vulnerability caused by improper modification of dynamically-determined object attributes in Cognito User Pool configuration, letting remote authenticated users escalate to deployment admin privileges via crafted UpdateUserAttributes API call.

Severity & Score

Impact

Remote authenticated users can escalate privileges to deployment admin and manage Cognito user accounts, risking full administrative control.

Mitigation

Redeploy from the updated repository and patch any forked or derivative code to incorporate the new fixes.

References

• https://github.com/aws/aws-ops-wheel/pull/165
• https://github.com/aws/aws-ops-wheel/security/advisories/GHSA-qvfh-9cjw-8wwq
• https://aws.amazon.com/security/security-bulletins/2026-018-aws/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner