AWS Fixes Auth Bypass in QnABot Lambda Hook Sample Affecting Versions 7.0.0-7.4.5
An authorization bypass flaw in an optional Amazon Q Business Lambda hook sample allows authenticated users to access arbitrary S3 objects in affected AWS accounts.
Key points
- CVE-2026-105811 affects QnABot on AWS versions 7.0.0 through 7.4.5.
- The vulnerability exists only in the optional Amazon Q Business Lambda hook sample.
- Users must update to version 7.4.6 and redeploy the specific hook stack to remediate.
Amazon Web Services (AWS) has released a security bulletin addressing an authorization bypass vulnerability identified in a sample solution for its QnABot on AWS service. The flaw, tracked as CVE-2026-105811, allows an authenticated remote user to read arbitrary Amazon S3 objects within the deploying AWS account.
At a glance
- Publisher
- AWS Security Bulletins
- CVEs
- CVE-2026-105811
The issue was discovered in the optional Amazon Q Business Lambda hook sample, known as `q-business-lambda-hook`. This component is part of the QnABot on AWS repository but is not deployed automatically with the main solution. It requires separate, manual deployment and additional setup by the customer. Consequently, customers who have not manually deployed this specific sample are not affected and do not need to take any action.
Context and Background
QnABot on AWS is a sample solution designed to provide a multi-channel, multi-language conversational interface. It functions as a chatbot that responds to customer questions, answers, and feedback. The vulnerable component is an integration sample included within the broader QnABot repository.
According to the AWS Security Bulletin published on October 6, 2026, the vulnerability stems from an authorization bypass through a user-controlled key. The bulletin classifies the content type as "Important," indicating it requires attention but does not necessarily represent a critical emergency for all users, given the optional nature of the affected component.
The vulnerability impacts QnABot on AWS versions 7.0.0 through 7.4.5. Any deployment using these versions that has also manually installed the Amazon Q Business Lambda hook sample is potentially exposed to unauthorized data access.
Who Is Affected
The scope of this vulnerability is limited to specific configurations. Only customers who have deployed the optional Amazon Q Business Lambda hook sample are at risk. The main QnABot on AWS service does not include this hook by default.
Users who have not performed the manual deployment steps for the `q-business-lambda-hook` are unaffected. AWS explicitly states that no action is required for these users. The vulnerability does not impact the core functionality of QnABot on AWS for those relying solely on the standard deployment.
What should you do?
Affected customers must take two distinct steps to remediate CVE-2026-105811. First, they must update their QnABot on AWS stack to version 7.4.6 or later. Second, they must redeploy the Amazon Q Business Lambda hook sample stack.
Updating the QnABot on AWS stack alone does not deliver the fix. The remediation requires the specific redeployment of the hook sample after the main stack update. AWS advises referring to its security bulletin for the most up-to-date and complete information regarding this issue.
What to do and how to stay safe: AWS
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-105811 affect all QnABot on AWS users?
No, the vulnerability only affects users who have manually deployed the optional Amazon Q Business Lambda hook sample.
What is the impact of this vulnerability?
An authenticated remote user can bypass authorization to read arbitrary Amazon S3 objects in the deploying AWS account.
How do I fix the issue if I am affected?
You must update QnABot on AWS to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack.
