Loading vulnerability…
AWS Ops Wheel v2 Cognito Attribute Privilege Escalation
CVE-2026-6912 is a privilege-escalation vulnerability in the Amazon Cognito User Pool configuration of AWS Ops Wheel v2 before PR #165. The Cognito UserPoolClient lacks WriteAttributes restrictions, allowing authenticated users to modify security-sensitive custom attributes on their own profiles. A crafted UpdateUserAttributes API call setting custom:deployment_admin causes the application to recognize the user as a deployment administrator on subsequent requests. Successful exploitation enables cross-tenant application data access and management of Cognito user accounts. AWS Ops Wheel v1 is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated low-privilege user can obtain deployment administrator privileges, read, modify, or delete application data across tenants, and manage Cognito user accounts within the deployment's User Pool. This compromises the confidentiality, integrity, and availability of application data and account administration.
If you can’t patch tonight, do this now.
Restrict Cognito UserPoolClient WriteAttributes so ordinary authenticated clients cannot modify custom:deployment_admin or custom:wheel_group_id. Enforce server-side verification of administrator email addresses against DEPLOYMENT_ADMIN_EMAILS rather than trusting user-modifiable privilege attributes alone.
Patch, then assume compromise.
Redeploy each affected AWS Ops Wheel v2 installation from an updated repository incorporating PR #165. The fix restricts client-side writes to custom:deployment_admin and custom:wheel_group_id and adds server-side email verification against DEPLOYMENT_ADMIN_EMAILS in authorization middleware and deployment administrator operations. Apply equivalent changes to forked or derivative code. Also incorporate PR #164 to address the separate JWT signature-verification vulnerability CVE-2026-6911; both fixes are needed to eliminate the disclosed escalation paths. Each customer-hosted deployment must be updated individually.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.