Impersonation Vulnerability in AWS Nitro Enclaves SDK
CVE-2026-119148

8.2HIGH

Key Information:

Vendor

Aws

Status
Aws-nitro-enclaves-sdk-c
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119148?

A vulnerability in AWS Nitro Enclaves SDK prior to version 0.4.6 allows potential impersonation of the AWS Key Management Service (KMS) endpoint due to incomplete string validation. This flaw could allow unauthorized access or manipulation of sensitive operations. To mitigate the risk, users are advised to rebuild any custom enclave image using the updated version 0.4.6 of the SDK.

Affected Version(s)

aws-nitro-enclaves-sdk-c 0 < 0.4.6

References

https://github.com/aws/aws-nitro-enclaves-sdk-c/releases/...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/aws/aws-nitro-enclaves-sdk-c/security/...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.