AWS patches SDK flaw that turned a region field into credential theft

Amazon Web Services has patched seven of its software development kits following a discovery by security startup Pi Inc. The flaw allowed attackers to extract sensitive credentials from targeted applications. AWS SDKs construct URLs for API calls using a template, inserting a region code in the middle like https://{service}.{region}.amazonaws.com.

The issue arose because no checks were in place to validate the region code, allowing attackers to insert arbitrary strings. Researchers at Pi Inc. exploited this by substituting a malicious region with "@attacker.com#". When the SDK built the URL and signed the request, it inadvertently revealed the attacker's server as the legitimate destination.

One particularly vulnerable call, AssumeRoleWithWebIdentity, transmitted a plaintext token that exposed Kubernetes service account credentials. Pi reported the issue to AWS on October 14, 2025, and the first patch was committed within a week. While the advisories followed later in January, AWS framed the fix as a defense-in-depth enhancement, emphasizing that validating input is the developer's responsibility.

The vulnerability, tracked as CVE-2026-22611, was rated low on the CVSS scale, with co-founder Guy Arazi acknowledged in the report. Pi Inc. tested the flaw in various embedded platforms, finding that all seven AWS SDKs were susceptible to credential leaking. The company is based in San Francisco and has raised $35 million in funding.