CVE-2026-18481

High

Description

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

SeverityHigh

CVSS7.3

Exploit probability—

ProductAWS Ops Wheel

PublishedJul 31, 2026

First seenJul 31, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Patches

github.com/aws/aws-ops-wheel/pull/168

Vendor advisories

aws.amazon.com/security/security-bulletins/2026-068-aws/

Affected products

Product	Affected versions	Fixed in
AWS AWS Ops Wheel	v ≤ PR168	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.