AWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injection

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsAWS databases-on-aws agent plugin permitted argument-driven shell execution: AWS disclosed CVE-2026-107322, command injection in databases-on-aws Agent Plugins affecting 1.0.0 to 1.7.0 under attacker-influenced helper arguments.

  AWS security bulletin, Impact and Affected versions.

• supportsAWS databases-on-aws agent plugin permitted argument-driven shell execution: AWS states that 1.7.1 contains the fix; the vulnerable code is a local agent helper, not a remotely listening Aurora database endpoint.

  AWS security bulletin, Resolution and affected component.

• supportsAWS databases-on-aws agent plugin permitted argument-driven shell execution: AWS dates marketplace availability of the correction to August 26, 2026, preceding its October 8 bulletin. Pinned checkouts need the corrected commit rather than an assumed release tag.

  Resolution, paragraphs 1-2; Publication Date.