CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)
CriticalCVSS 9.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.
To remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AWS trusted-remote-execution | All versions | No fix listed |
References
- aws.amazon.com vendor-advisory
- github.com third-party-advisory