AWS Ops Wheel Flaws Allowed Forged Tokens and Cross Tenant Administrative Access
AWS has published bulletin 2026-018-AWS covering two vulnerabilities in AWS Ops Wheel, an open-source tool that helps teams make random selections using a virtual spinning wheel and is deployed into customer AWS accounts through CloudFormation. CVE-2026-6911 and CVE-2026-6912 both affect AWS Ops Wheel v2 deployments built from PR #163 and earlier. The first allows an unauthenticated actor with network access to the API Gateway endpoint to obtain unintended administrative access to the application. The second allows an already authenticated user to raise their own privileges within the deployment. Because the tool runs inside the customer's own account rather than as a managed service, exposure depends entirely on when each team last deployed the stack and whether they are running a forked copy.
The two issues are independent of one another. CVE-2026-6911 stems from the v2 API not enforcing JWT token signature verification, meaning a token presented to the API Gateway endpoint was trusted on the strength of its contents rather than its cryptographic signature. An actor able to reach that endpoint could craft a token asserting administrative rights and have the application accept it, with no valid credentials involved. CVE-2026-6912 sits in the v2 Cognito User Pool configuration, where attribute write permissions were insufficiently restricted, letting a signed-in user modify the very attributes that define their own privilege level. Both paths lead to the same outcome described in the bulletin: the ability to read, modify and delete application data across tenants and to manage Cognito user accounts within the deployment's User Pool. AWS addressed CVE-2026-6911 in PR #164 and CVE-2026-6912 in PR #165.
The weight here comes from what sits behind the wheel rather than the wheel itself. Control over a deployment's Cognito User Pool is identity infrastructure, and an actor able to create or alter accounts there holds a durable position that survives the loss of any single forged token. Cross-tenant data access also means one weak deployment exposes every team sharing it. On current exploitation status, FIRST EPSS places CVE-2026-6911 at a 0.4 percent probability of exploitation in the next 30 days and CVE-2026-6912 at 1.0 percent, and no in-the-wild activity has been reported. Forked and derivative deployments remain the quieter exposure, since an upstream fix does not reach them.
Attack Surface
Cloud Service, Web Application
Tactics
Initial Access, Credential Access, Privilege Escalation, Persistence
Techniques
- T1190 – Exploit Public-Facing Application
- T1606 – Forge Web Credentials
- T1548 – Abuse Elevation Control Mechanism
- T1098 – Account Manipulation
SuperPRO's Threat Countermeasures Procedures
- Redeploy AWS Ops Wheel v2 from the latest upstream version, which includes PR #164 for the JWT signature verification failure (CVE-2026-6911) and PR #165 for the Cognito attribute write restriction (CVE-2026-6912); any stack built from PR #163 or earlier is vulnerable.
- Identify forked or derivative Ops Wheel v2 repositories in your organisation and port the PR #164 and PR #165 changes into them, since redeploying the upstream CloudFormation template will not fix code you maintain separately.
- Where redeployment cannot happen immediately, apply the AWS-documented workaround and place AWS WAF in front of the Ops Wheel API Gateway endpoint or move it behind a VPC endpoint so only known corporate ranges can reach it.
- Audit the Cognito User Pool attached to each Ops Wheel v2 deployment for unexpected admin or privilege attributes on user records, and review the app client's write permissions to confirm privilege-bearing custom attributes are no longer user-writable.
- Review Amazon Cognito CloudTrail events for the deployment's User Pool – specifically AdminCreateUser, AdminUpdateUserAttributes, UpdateUserAttributes and AdminAddUserToGroup – and alert on privilege attribute changes that did not originate from an administrator session.
- Enable and retain API Gateway execution and access logging for the Ops Wheel v2 API, and alert on requests that carry an admin-scoped JWT but do not correlate to a preceding Cognito authentication event.
- Treat any deployment confirmed as reachable from the internet while running PR #163 or earlier as potentially accessed: rotate Cognito user credentials in that User Pool and validate application data across all tenants for unauthorised modification or deletion.
