high severity · published 2026-11-11
An authenticated remote user can trick the gateway into sending requests to internal network services and cloud instance metadata endpoints, then read the responses. This can expose internal resources and cloud credentials.
Fixed in: 1.35.0
CVE: CVE-2026-125926
Source: aws.amazon.com
You are affected if the installed version is older than 1.35.0. Check the version you have and update to 1.35.0 or later. The fixed version is verified against a vendor or advisory source.
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2559 and your operating system.