High severity7.3NVD Advisory· Published Jul 31, 2026· Updated Aug 4, 2026

CVE-2026-18481

Description

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme.

To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AWS/AWS Ops Wheelllm-fuzzy
Range: < PR #168

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-068-aws/nvd
github.com/aws/aws-ops-wheel/pull/168nvd
github.com/aws/aws-ops-wheel/security/advisories/GHSA-6rr8-cf9x-pj23nvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000