AWS Fixes Critical Loom and SageMaker Flaws Enabling Code Execution and Credential Theft

AWS released patches for four critical vulnerabilities in the open-source Loom AI agent orchestration platform and Amazon SageMaker Unified Studio (CVE-2026-103956, CVE-2026-103957, CVE-2026-103958, CVE-2026-104019) that can enable authentication bypass, OAuth2 token disclosure, SSRF-based access to internal endpoints and temporary AWS credentials, and OS command injection leading to arbitrary code execution; AWS recommends upgrading Loom to 1.7.0, patching SageMaker Distribution images, restricting mcp:write and a2a:write scopes, requiring identity providers for Loom, rotating OAuth client secrets and tokens, and reviewing CloudTrail logs.