CVE-2026-6912: Aws Ops Wheel

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

• Aws Aws Ops Wheel: before 164 (fixed in 164)

Published 2026-04-24. Last modified 2026-06-17.