CVE-2026-18481

DiscoveredJul 31, 2026UpdatedOct 23, 2026

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

View graph Watch Export

CVSS v3.1

7.3 HIGH

EPSS

0.51%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 25, 2026

▲ 0.23pp

0.28% → 0.51% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Connections

2 relationships

CWE-79

source

Timeline

disclosure → media coverage

Jul 31, 2026

Disclosure — published as a CVE record. · last revised by NVD Oct 23, 2026

Aug 20, 2026

aws.amazon.com reports: CVE-2026-18481 - Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft