AWS Ops Wheel v2 flaws enabled admin takeover via JWT forgery and Cognito abuse

AWS disclosed two critical vulnerabilities in AWS Ops Wheel v2 that could let attackers seize full administrative control of customer deployments. CVE-2026-6911 stems from missing cryptographic verification of JWT signatures in the v2 API, allowing an unauthenticated attacker with network access to the API Gateway endpoint to forge tokens with arbitrary tenant and administrator claims. The flaw could expose all application data across tenants and permit management of Amazon Cognito user accounts; it affects deployments built from PR #147 through PR #163, while v1 is not affected. GitHub advisory GHSA-v5vr-8w3c-37x2 says the issue was fixed in PR #164, and temporary mitigations include restricting API Gateway access with AWS WAF or VPC controls.

A second issue, CVE-2026-6912, allowed any authenticated user to escalate privileges by modifying self-writable security-sensitive Cognito attributes such as custom:deployment_admin through the Cognito UpdateUserAttributes API. An attacker could promote their own account to deployment administrator, then read, modify, or delete cross-tenant data and manage all users in the deployment’s Cognito User Pool. That flaw affects the same PR #147-#163 range and was fixed in PR #165 by tightening Cognito WriteAttributes and adding server-side email verification tied to DEPLOYMENT_ADMIN_EMAILS. Because Ops Wheel is deployed into customer AWS accounts through CloudFormation, each affected deployment and any forks or derivative code must be individually updated.