CVE-2026-122193

Summary

An OS command injection flaw exists in the example SSM document provisioning script for Trusted Remote Execution (REX) before 2026-07-28, allowing authenticated users with permission to invoke Rex-RO or Rex-RW documents to execute arbitrary commands as root on managed instances by bypassing Cedar policy enforcement.

Exploitability

Exploitation requires valid authentication and specific permissions to invoke the vulnerable SSM documents (Rex-RO or Rex-RW), but is otherwise straightforward for an attacker meeting those conditions.

Blast radius

Successful exploitation grants root-level command execution on managed instances, enabling full compromise of affected systems, data exfiltration, lateral movement, and persistence.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Delete all Rex-RO and Rex-RW SSM documents created from the example script in each AWS account and Region where it was run; no fixed version is specified beyond the date-based cutoff (2026-07-28), so immediate removal of affected documents is the only remediation provided.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.