ICYMI: August 2026 @AWS Security

What it is

This ICYMI roundup's security bulletins (23 total) contain a specific, reproducible RCE chain worth isolating from the rest of the digest: path-traversal-to-root in amazon-ssm-agent, Zip Slip in awsdac, and an uncontrolled search path vulnerability in Kiro IDE and CLI specifically on Windows. The existing summary names the first two bugs but omits the Windows-specific scoping of the Kiro flaw and the broader RCE pattern the page draws across unrelated components.

How it works

The page groups these under a stated common thread: "insufficient authorization and input validation at the boundary between AI agents and the systems they reach." Specific mechanisms named: prototype pollution and Java deserialization in OpenSearch, path-traversal-to-root in amazon-ssm-agent, Zip Slip (archive extraction path traversal) in awsdac, and uncontrolled search path (DLL/binary hijacking pattern) in Kiro IDE/CLI — the last one affecting Windows only.

Preconditions / Affected

• amazon-ssm-agent — path traversal escalating to root.
• awsdac — Zip Slip, triggered via archive extraction.
• Kiro IDE and CLI — uncontrolled search path, Windows only.
• AWS CLI — disabled SSH host key verification (separate issue, not version-gated in the text).
• AWS SDK for C++ — memory-safety flaws.
• FreeRTOS-Kernel — privilege escalation.
• Amazon ion-java — memory-amplification denial of service.
• Athena Federated Query connectors — expose Secrets Manager secrets.
• OpenSearch — authorization, input validation, SSRF, stored XSS, and DoS issues span "a large share" of the month's bulletins.

No CVE numbers, version boundaries, or patched-version numbers are given in the fetched text for any of these.

What to do

The page states only: "All patches are available, upgrade promptly." It directs readers to the AWS Security Bulletins page for details rather than giving per-component versions or commands.

Caveats

The page does not provide CVE identifiers, affected/fixed version numbers, or exploitation prerequisites (e.g., required privilege level) for any of the listed RCE/DoS bugs — these details exist only behind the "AWS Security Bulletins" link, not in the text fetched here. Treat this document as a pointer to which specific bugs need bulletin lookup, not a substitute for reading the bulletins.