CVE-2026-105811: aws qnabot-on-aws

Vulnerability summary

CVE-2026-105811 is a high (CVSS 7.1) vulnerability in aws qnabot-on-aws. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25% of scored vulnerabilities.

Timeline

1. 06-10-2026
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account. This sample solution provides an example Lambda hook and requires separate, manual deployment and additional setup. It is not deployed automatically with QnABot. Customers who have not deployed this optional sample hook are not affected and do not need to take action. To remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.