Key points
- CVE-2026-107322 affects versions of the AWS databases-on-aws plugin prior to 1.7.1.
- The vulnerability stems from an incomplete list of disallowed inputs, classified as CWE-184.
- Attackers can execute arbitrary operating system commands on the host running the helper.
The short version
- Amazon has released version 1.7.1 of the databases-on-aws plugin to address a high-severity remote code execution flaw.
- The bug allows unauthenticated, remote actors to inject operating system commands through the agent context.
- Users must upgrade to version 1.7.1 or later and confirm the update is active in their environments.
The details
The National Vulnerability Database records CVE-2026-107322 with a CVSS score of 8.5, rating the issue as HIGH severity. The flaw exists within the Amazon Agent Plugins for AWS, specifically the databases-on-aws component in versions preceding 1.7.1.
The root cause is identified as CWE-184: Permissive List of Allowed Inputs. According to the NVD description, the plugin maintained an incomplete list of disallowed inputs. This gap allowed a remote, unauthenticated actor to introduce a crafted database command value into the agent context. When processed, this crafted value bypassed input validation, enabling the execution of arbitrary operating system commands on the host machine running the helper service. This results in remote code execution (RCE) without requiring any prior authentication credentials.
The context
AWS Security Bulletins published an official advisory regarding this OS command injection vulnerability. The bulletin identifies the affected software as the AWS databases-on-aws plugin and confirms the release of a mitigation. The vulnerability was disclosed via the standard CVE process, with the specific identifier CVE-2026-107322 assigned to track the issue. The advisory provides a direct link to the security bulletin RSS feed for further reference.
What should you do?
Users operating the databases-on-aws plugin must upgrade to version 1.7.1 or later. The source material explicitly states that simply installing the update is insufficient; administrators must verify that the updated plugin is active in each environment where the software is deployed. No other mitigation is listed in the provided material.
What to do and how to stay safe: AWS
- Automation eliminates human delay but increases the risk of deploying untested code into production.
- Silent failures in update mechanisms can leave systems unprotected without triggering alerts.
- Version pinning prevents automatic upgrades from breaking dependent services or APIs.
Automatic updates reduce exposure time but require rigorous testing and rollback capabilities to prevent service disruption. Implement version pinning and signature verification to maintain control over your software environment.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AWS plugin versions are affected by CVE-2026-107322?
All versions of the AWS databases-on-aws plugin before version 1.7.1 are affected.
What is the CVSS score for this vulnerability?
The CVSS score is 8.5, which is rated as HIGH severity.
How does the attack work?
An attacker sends a crafted database command value through the agent context, exploiting an incomplete list of disallowed inputs to execute OS commands.
