Critical Vulnerability in Loom
Loom, an open-source platform for managing agents on Amazon Bedrock AgentCore Runtime and AWS Strands Agents, is affected by a critical authentication bypass vulnerability, CVE-2026-103956. Detailed in GitHub Security Advisory GHSA-vgmj-998f-r8mp and covered by GBHackers, this flaw allows unauthenticated remote attackers to gain administrative access to the agent control plane.
The Mechanics of Unconditional Access
In versions of Loom prior to 1.6.1, the authentication dependency at backend/app/dependencies/auth.py contained a hardcoded fallback. When deployed without a configured identity provider (IdP), the get_current_user function returned a fixed identity: t-admin/g-admins-super. This default state granted super-admin authority to any unauthenticated user.
An attacker with this access can register malicious tool servers, exfiltrate integration credentials, or modify IAM role policies. By manipulating these policies, an attacker can escalate privileges from the agent orchestration layer into the underlying AWS environment.
Companion Vulnerabilities and Codebase Health
The security advisory for Loom included two additional vulnerabilities, CVE-2026-103957 and CVE-2026-103958, both affecting versions prior to 1.7.0. CVE-2026-103957 involves OAuth2 token disclosure via outbound request handling, while CVE-2026-103958 describes a Server-Side Request Forgery (SSRF) vulnerability within the MCP tool server and A2A agent connection handling. These highlight the risks inherent in complex inter-service communication.
The Trust-Through-Defaults Pattern
This incident reflects the trust-through-defaults pattern identified in our analysis of the agent identity layer. Systems designed with permissive defaults that assume a secure, isolated environment often leave those defaults active in production. Whether it is the misconfiguration of ZITADEL or the hardcoded identity fallback in Loom, the system trusts the request because it has not been explicitly told not to.
The orchestration layer is becoming the primary target for identity-based attacks. As organizations move to complex agentic workflows, the platform managing these agents inherits the risks of its default configurations. The shift toward agent-to-agent (A2A) communication and MCP server integration increases the surface area for these attacks.
Remediation and Operational Review
Fixing CVE-2026-103956 requires updating Loom to version 1.6.1 or later. Because the vulnerability allowed for potential credential theft and IAM policy modification, a patch alone does not restore environment integrity. Organizations that deployed Loom must assume the control plane was compromised if it was exposed to a network without an IdP.
The remediation process must be thorough. First, all OAuth2 client secrets must be rotated. Second, any access tokens currently in circulation should be revoked and reissued. Third, all IAM session credentials managed by the platform must be rotated. Finally, a comprehensive review of CloudTrail logs is necessary to identify unauthorized API calls made while the instance was running in its default, unauthenticated state.
Securing the Orchestration Layer
The existence of a public proof-of-concept repository, abraxas/cve-2026-103956-loom-unauth, underscores the urgency of these steps. For organizations building on AWS, the orchestration layer is a high-value target that requires the same identity rigor as a production database or core IAM service. Default configurations must be treated as insecure until proven otherwise.