AWS warns of CVE-2026-122193, a command injection flaw in REX setup guide examples
VULNERABILITYCVE-2026-122193redteam/daily · 1 source
- Severity
- Medium
- Highest CVSS
- 9.3
- Exploited
- Not known
- Sources
- 1
What happened
AWS has published bulletin 2026-173-AWS for CVE-2026-122193, an OS command injection issue in the example script in the Trusted Remote Execution (REX) setup guide. The script creates AWS Systems Manager (SSM) documents Rex-RO and Rex-RW, and poor handling of input parameters let a user with permission to invoke those documents run commands on managed instances outside the REX sandbox. The scriptArgs parameter is affected by the same class of issue, but AWS states this is not an issue in any shipped REX artifact version.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether you created the Rex-RO or Rex-RW SSM documents using the example script from the REX setup guide.
- Review who holds permission to invoke those SSM documents and remove any access that is not needed.
- Read the full AWS bulletin 2026-173-AWS for the latest and most complete information.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies