OS Command Injection in Trusted Remote Execution Product by Amazon Web Services

CVE-2026-122193

What is CVE-2026-122193?

CVE-2026-122193 is a significant security vulnerability found in the Trusted Remote Execution (REX) solution developed by Amazon Web Services (AWS). This vulnerability arises from an OS command injection flaw in the example SSM (Systems Manager) document provisioning script. It affects the ability of the system to enforce policy security measures, specifically bypassing Cedar policy enforcement. If exploited, this vulnerability allows authenticated remote users with the appropriate permissions to invoke either Rex-RO or Rex-RW SSM documents, enabling them to execute arbitrary commands as the root user on the managed instances. This poses a serious risk to organizations relying on this AWS service, as it can lead to unauthorized access and control over critical systems and sensitive data.

Potential impact of CVE-2026-122193

1. Unauthorized Command Execution: Attackers could exploit this vulnerability to gain root access and execute arbitrary commands, leading to unauthorized modifications, data exfiltration, or system manipulation.

2. Policy Bypass: The ability to bypass Cedar policy enforcement undermines the security architecture of the Trusted Remote Execution service, potentially allowing for further exploitation and increased attack surfaces.

3. Heightened Risk of Data Breaches: The exploitation of this vulnerability increases the likelihood of significant data breaches, as attackers could gain access to sensitive information and leverage it for malicious purposes, including corporate espionage or ransom demands.

References