CVE-2026-6912
Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.
- Published Apr 24, 2026
- CVSS 8.7 high
- 1.0% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- Issue with AWS Ops Wheel (CVE-2026-6911 and CVE-2026-6912 AWS Security Bulletins ·