Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-107322 Details

Description

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: AMZNCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://aws.amazon.com/security/security-bulletins/2026-130-aws/ AMZN
https://github.com/awslabs/agent-plugins/commit/8b13a503746a4ebb0402b936645163224058bde3 AMZN
https://github.com/awslabs/agent-plugins/pull/232 AMZN

Weakness Enumeration

CWE-IDCWE NameSource
CWE-184Incomplete List of Disallowed InputsAMZN

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-107322
NVD Published Date:
Oct 8, 2026
NVD Last Modified:
Oct 8, 2026
Source:
AMZN
CVE-2026-107322 Details - Not Deferred