Description
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint.



To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Published: 2026-10-30
Score: 8.2 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Title Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
First Time appeared Aws
Aws aws-nitro-enclaves-sdk-c
Weaknesses CWE-807
CPEs cpe:2.3:a:aws:aws-nitro-enclaves-sdk-c:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-nitro-enclaves-sdk-c
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}

Subscriptions

Aws Aws-nitro-enclaves-sdk-c
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-30T18:08:59.904Z

Reserved: 2026-10-29T14:31:17.882Z

Link: CVE-2026-119148

cve-icon Vulnrichment

Updated: 2026-10-30T18:02:02.966Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T17:17:16.493

Modified: 2026-10-30T19:23:54.487

Link: CVE-2026-119148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T18:15:07Z

Weaknesses
  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision