OS command injection in the example SSM documents in Trusted Remote Execution (REX)
Only the example SSM documents Rex-RO and Rex-RW, created by following the set-up guide's example script, contain this issue. Shipped REX artifact versions are not affected, and no fix is listed yet.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The example SSM documents (Rex-RO and Rex-RW) were created by following the set-up guide's example script. Not an issue in a shipped REX artifact version; it only affects the example in the set-up documentation.
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 23/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Trusted Remote Execution (REX) example SSM documents contain an OS command injection flaw in their provisioning script. An attacker with low-privilege login who is permitted to invoke the Rex-RO or Rex-RW SSM document can reach it remotely over the network and run arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.
Read the original description
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.
To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.9/10CVSS 9.9
- No patch5/5No patch listed yet
What would change the score
- Would score about 73 if added to CISA KEV
- Would score about 68 if CISA's SSVC rates exploitation active
- Would score about 30 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
The example SSM documents (Rex-RO and Rex-RW) were created by following the set-up guide's example script. Not an issue in a shipped REX artifact version; it only affects the example in the set-up documentation.Workaround: The checked facts give no workaround and list no fix. They do not say what to change in the example documents, so the advisory itself should be consulted for guidance.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- AWS trusted-remote-execution
Version range not reported
Evidence 3
- Advisory
- Advisory
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-122193
Is CVE-2026-122193 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A user permitted to invoke the SSM document can run unintended operating system commands on the managed instance, outside the REX sandbox.Source: github.com, aws.amazon.com
Am I affected, and how do I check?
The issue is in the example SSM documents Rex-RO and Rex-RW, created by following the set-up guide's example script. The guide says it is not an issue in a shipped REX artifact version. To check, see whether your SSM documents were created from that example script.Source: github.com, aws.amazon.com
How do I fix CVE-2026-122193?
The checked facts list no fixed version, so no upgrade target is given. Review any SSM documents that were created from the set-up guide's example script.Source: github.com, aws.amazon.com
What if there's no patch?
The checked facts give no workaround and list no fix. They do not say what to change in the example documents, so the advisory itself should be consulted for guidance.Source: github.com, aws.amazon.com