Vulnerability Bulletins |
CVE-2026-18481 |
|
| Affected software | AWS |
|
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel. |
|
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-18481 | |