Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
High

Privilege Escalation in AWS Ops Wheel v2 Cognito User Pool Configuration

IdentifiersCVE-2026-6912CWE-915· Improperly Controlled Modification…

CVE-2026-6912 is a privilege-escalation vulnerability in AWS Ops Wheel v2 caused by improper control over writable Amazon Cognito user attributes in the User Pool Client configuration. In affected deployments before PR #165, the Cognito UserPoolClient did not sufficiently restrict WriteAttributes for security-sensitive custom attributes used by the application’s authorization logic, including custom:deployment_admin and reportedly custom:wheel_group_id. As a result, any authenticated user in the deployment’s Cognito User Pool could invoke the Cognito UpdateUserAttributes API against their own profile and set custom:deployment_admin to a privileged value. On subsequent requests, the application trusted that attribute and treated the attacker as a deployment administrator. The issue is classified as CWE-915. Available context indicates AWS Ops Wheel v2 deployments from PR 147 through PR 163 are affected; v1 is not affected.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a low-privileged authenticated user to escalate to deployment administrator within the affected AWS Ops Wheel v2 deployment. With that access, the attacker can manage Cognito user accounts and, according to the provided context, read, modify, and delete all application data across tenants. The vulnerability therefore has high confidentiality, integrity, and availability impact within the deployment.

Mitigation

If you can’t patch tonight, do this now.

If immediate redeployment is not possible, restrict or remove client-side write access in the Cognito User Pool Client to all security-sensitive custom attributes, especially custom:deployment_admin and custom:wheel_group_id. Independently enforce server-side authorization checks so administrative status is not derived solely from user-writable Cognito attributes. Review existing user profiles for unauthorized changes to privileged custom attributes, revoke improperly granted admin access, and rotate or review credentials and sessions associated with suspicious accounts. Limit exposure by tightly controlling who can obtain authenticated Cognito accounts in the affected deployment until the fix is applied.

Remediation

Patch, then assume compromise.

Redeploy AWS Ops Wheel from the updated repository containing the fix in PR #165. The fix restricts Cognito UserPoolClient WriteAttributes for sensitive fields such as custom:deployment_admin and custom:wheel_group_id and adds server-side email verification tied to DEPLOYMENT_ADMIN_EMAILS for deployment-admin authorization paths. Any forked or derivative AWS Ops Wheel code should be reviewed and patched to incorporate the same controls. Because AWS Ops Wheel is deployed into customer AWS accounts via CloudFormation, each customer deployment must be individually updated. The provided context also states that PR #164 and PR #165 should both be applied to eliminate all known escalation paths in AWS Ops Wheel v2.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Amazon Web ServicesAws Ops Wheelapplication
Amazon Web ServicesOps Wheelapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.