AmazonAnalysisAWS resolves command injection defect in Trusted Remote Execution SSM documents
What happened.Amazon Web Services published security bulletin 2026-173-AWS removing vulnerable sample Systems Manager documents for Trusted Remote Execution.
Why it matters.Systems Manager documents automate operations across fleet instances with elevated instance profile permissions. When sample documents unsafely concatenate parameter strings, authenticated operators execute arbitrary shell commands that bypass Cedar authorization policies. Security operations engineers should audit account inventories for custom Rex SSM documents. DevOps leads should replace concatenated parameter scripts with strictly typed SSM parameter schemas.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-122193, an input handling flaw in sample SSM documents permitted authenticated users to inject arbitrary OS commands.
- Sandbox breakout: Attackers invoking the Rex-RO and Rex-RW example documents could pass crafted script arguments that escaped the intended Cedar policy sandbox.
- Target environment: The setup guide enabled customers to configure confidential execution pipelines and policy-governed administration across EC2 instances.
- Documentation removal: AWS updated the Trusted Remote Execution setup documentation, stripping out the insecure script parameter parsing patterns.
- Customer remediation: AWS advised administrators who deployed custom SSM documents using the setup guide examples to delete Rex-RO and Rex-RW templates immediately.