Description
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint.



To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Published: 2026-10-30
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Title Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
First Time appeared Aws
Aws aws-nitro-enclaves-sdk-c
Weaknesses CWE-807
CPEs cpe:2.3:a:aws:aws-nitro-enclaves-sdk-c:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-nitro-enclaves-sdk-c
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}

Subscriptions

Aws Aws-nitro-enclaves-sdk-c
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-30T18:08:59.904Z

Reserved: 2026-10-29T14:31:17.882Z

Link: CVE-2026-119148

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T17:17:16.493

Modified: 2026-10-30T17:17:16.493

Link: CVE-2026-119148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T18:15:07Z

Weaknesses