Bulletin ID: 2026-068-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/31/2026 11:00 AM PDT

Description:

AWS Ops Wheel is an open-source operational decision-making tool published under the AWS GitHub organization and self-deployed by customers into their own AWS accounts via CloudFormation. The application did not sufficiently validate the participant URL field — server-side validation checked only the value's length, not whether it was a safe web URL (CWE-79) — so a user with participant-management permission (a Wheel Admin/Admin) could store a crafted URL that could execute script in another user's authenticated browser session (stored cross-site scripting).

Impact is confined to a single self-deployed instance (each deployment has its own Cognito user pool); there is no cross-deployment impact and no impact to any AWS-managed service.

Impacted versions: AWS Ops Wheel v2 deployments PR #168 and earlier

Resolution:

This issue has been addressed in PR #168 with defense-in-depth: server-side validation now restricts participant URLs to http/https schemes on create and update; the client hardens how stored URLs are rendered; and session tokens are no longer stored in a location accessible to page scripts. Because AWS Ops Wheel is deployed from source, we recommend updating your checkout to a revision that includes this fix, redeploying both the API and UI, and ensuring any forked or derivative code is patched.

Workarounds:

Until you can redeploy the patched code: restrict Wheel Admin/Admin permissions to trusted users only; audit stored participants and remove any participant URL that is not a standard http/https URL; avoid interacting with participant entries originating from unintended users; and apply a strict Content-Security-Policy at your CloudFront/reverse proxy (a partial stopgap, not a substitute for the patch).

References:

• CVE-2026-18481
• GHSA-6rr8-cf9x-pj23

Please email aws-security@amazon.com with any security questions or concerns.