takenaka hiroya@Joe_Biden_ja
AWSエミュレータ Floci の API Gateway テンプレート処理に、認証なしでコマンドを実行できる欠陥（CVE-2026-108598、CVSS 9.8）。2.2.0 で修正済みです。開発環境で使っている方は版を確認してください。 https://cve.autoarticles.net/cve/CVE-2026-108598
0000035
557 followersView on X
CVE-2026-108598
LOWCVSS 9.3 · CRITICALSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/floci-io/floci
- https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114
- https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4
- https://github.com/floci-io/floci/releases/tag/2.2.0
- https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx
Weakness type (CWE)
CWE-94
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Threat summary
- 2 mentions across 2 observed days
- Momentum state: stable
What's happening
- Peaked 1d ago at 1 mentions (2026-10-10); latest day: 1
- 2 total mentions across 2 days
Deep dive
Activity timeline2 mentions / 2d
Referenced assets1 URL
By indicator
Full discourse2 posts
Atlas Threat Monitoring@ThreatAtlasUnpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-108598 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-10 A critical vulnerability (Code Injection) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown
0000083457 followersView on X