AWS databases-on-aws agent plugin: crafted database command in agent context runs OS commands on the host

Impact

The databases-on-aws plugin for Amazon Agent Plugins filters disallowed inputs incompletely, so a database command value introduced into the agent's context can break out into arbitrary operating-system commands on the machine running the helper. Where an LLM agent is wired to this plugin, the command value can arrive from content the agent reads rather than from the operator, which turns untrusted text in a prompt, ticket or query result into code execution with the agent runner's privileges and credentials. On a fleet where agents run alongside jobs or on an operator workstation that holds cloud credentials, that is a path from prompt content to the AWS role the agent runs under. CVSS records it as local vector with user interaction required (AV:L/UI:P), consistent with the command having to pass through an agent invocation rather than being sent directly to a listening service.

Who can reach it

Remote unauthenticated actor who can get a crafted database command value into the agent's context, with the agent or its user then invoking the plugin. No credentials on the host are needed by the attacker; execution lands with the privileges of the process running the plugin helper.

What to do

Upgrade the databases-on-aws plugin to 1.7.1 or later and confirm the updated plugin is the active one in every environment where it is installed - AWS bulletin 2026-130 notes the verification step explicitly, because a stale copy in another environment stays vulnerable. The fix is commit 8b13a503 (PR 232). Restarting the agent process that loads the plugin is enough; no node drain is required. Review any credentials the agent host held if untrusted content reached the plugin before the upgrade.

References

Related entries

• BentoML: newline in docker.env keys injects Dockerfile instructions during bentoml containerizeCVE-2026-112264 · BentoML (containerize, legacy base.j2 Dockerfile template)High
• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• vLLM: remote processor code executes even when trust_remote_code is falseCVE-2026-90553 · vLLM (LlavaOnevision2 processor loader)High