We didn't find this in a whitepaper. We found it in one branch of one function โ get_current_user, sitting in backend/app/dependencies/auth.py, returning a hardcoded identity named t-admin/g-admins-super the moment no identity provider is configured. No token. No session. No signature. Just a fallback that hands superadmin to anyone who asks.
That's CVE-2026-103956, the first of three flaws disclosed against Loom, an open-source platform built to orchestrate AWS Bedrock AgentCore Runtime and Strands Agents. The other two: an OAuth2 token leaking through outbound requests (CVE-2026-103957), and SSRF inside MCP/A2A connection handling (CVE-2026-103958). Together they form a kill chain running from an anonymous HTTP request to IAM policy modification inside a live AWS account.
This isn't a model bug. It's a control-plane bug. And in a tape where every copy-trading bot and every "autonomous DeFi" pitch now routes through this exact class of orchestration layer, the timing is ugly.
Board first. Loom is โ or claims to be โ an open-source agent orchestration platform. Its job is to sit above the runtime and manage the plumbing: authenticate operators, store integration credentials, and broker MCP and A2A traffic between agents. In other words, it's the credential hub. Everything downstream โ every tool, every agent, every cloud resource โ inherits the identity Loom hands out.
That's the whole game. When a platform sits at the credential hub, breaking it isn't breaking one service. It's breaking everything it vouches for. This is the confused-deputy problem in its purest form: the orchestrator holds high-privilege credentials and calls downstream services on the attacker's behalf, wearing a trusted face.
Three flaws, three layers. Authentication bypass (103956) gets you in. OAuth2 token leakage (103957) hands you the keys on the way through. SSRF in MCP/A2A connection handling (103958) turns the orchestrator into a jump box pointed at your internal network. Map it to CWE and you get CWE-287, CWE-1188, and CWE-798 stacked into one compound defect.
The version timeline is the detail everyone skips. 103956 was patched in 1.6.1. The other two landed in 1.7.0. Anyone who upgraded to 1.6.1, felt safe, and stopped reading is still fully exposed to token leakage and SSRF. A partial fix is a trap โ it tells you you're done when you're not.
And there's a public PoC โ abraxas/cve-2026-103956-loom-unauth โ which drops the exploit bar to "can you clone a repo." That's not a theoretical risk profile. That's a live one.
Now the caveat, and I don't bury it. The CVE numbering is odd โ six digits. The sourcing runs through a single aggregator plus one GitHub advisory. And I cannot independently verify that this Loom product exists as described. I'm analyzing the pattern, not vouching for the event. The pattern is real regardless. Keep that distinction.
Here's the technical read โ and why it should scare anyone running agents against real money.
Start with the fallback. A fail-open authentication path isn't a subtle bug; it's a design decision with a signature. The system trusts a request not because it verified it, but because it was never told not to. That's the inverse of fail-secure. Security systems deny by default and grant by exception. Loom's default is the exception. In dev, that's a convenience โ no IdP to configure, no friction, ship faster. In production, it's a skeleton key. The only thing separating the two is a config flag nobody enforces at boot.
Now watch how clean the chain is. Step one, authentication bypass: hit the endpoint with no credentials, and get_current_user falls through to the hardcoded branch. You are now t-admin/g-admins-super. No exploit code. The bug is the feature.
Step two, credential theft: register a malicious MCP tool server. The orchestrator, believing it's talking to a trusted integration, hands over the OAuth2 secrets it holds. 103957 is the exfil channel โ the outbound request carrying your token carries the platform's too.
Step three, lateral movement to cloud: with integration credentials and a superadmin context, you rewrite IAM role policies. The orchestrator's own permissions become yours. You've climbed from anonymous internet request to inside the AWS environment without touching a single model weight.
Step four, SSRF as the tunnel: MCP and A2A both let agents connect to external endpoints. With no URL allowlist and no internal-network filtering, that connection is a doorway into the corporate intranet. 103958 is the door.
That's a complete kill chain: authenticate, steal, escalate, tunnel. Every layer is a place the industry quietly assumed was someone else's problem.
There's a detail the advisory leaves dangling. The SSRF mitigation isn't described โ URL allowlist? Network isolation? DNS rebinding protection? We don't know, and that decides whether the fix is a wall or a speed bump. Same with credential storage: encrypted, tenant-isolated, or does one compromised tenant burn the whole platform? Those gaps are where the next CVE lives.
Read the three bugs as one thing, because that's what they are. Authentication, credential transport, outbound requests โ identity, secrets, network. That's the full perimeter of a control plane. When all three crack at once, it isn't three bugs. It's an architecture admitting it was never built to be attacked.
The market impact is the part people underestimate. I run copy-trading infrastructure that touches this exact stack, so I read the advisory twice. Think about who runs these orchestrators. Copy-trading communities. AI-agent frameworks routing on-chain actions. Trading desks wiring MCP servers straight into execution. Every one now holds a credential hub that, if defaulted to fail-open, is a single point of failure for the entire stack beneath it.
And the remediation isn't a patch. A patch restores the code; it does not restore the environment. If an un-IdP'd Loom was ever exposed, assume the control plane is already compromised. Rotate every OAuth2 secret. Revoke every issued token. Rotate IAM credentials. Audit CloudTrail for access patterns that shouldn't exist. Anything less is theater. "Already leaked is already leaked" isn't pessimism โ it's the only honest accounting.
Here's where the crowd gets it wrong. The reflexive take is "open-source project has a bug, patch it, move on." That reads the event at the bug level. The real story is architectural โ and it's uncomfortable for the whole agent ecosystem, including the closed, hosted ones everyone assumes are safer.
The pattern that broke Loom โ trust-through-defaults โ isn't an open-source disease. It's a product-culture disease. Fail-open paths ship because they lower onboarding friction, and onboarding friction is the metric every platform team is graded on. Hosted orchestrators have the same incentive, just better marketing around "shared responsibility." The difference between Loom and a cloud-managed alternative isn't whether the default is dangerous. It's whether you're allowed to see it.
The second blind spot: everyone frames MCP and A2A as interop wins. Fewer people frame them as expanded trust boundaries. Each new protocol connection is a new place where an untrusted endpoint becomes an input. SSRF in connection handling isn't a Loom bug โ it's a protocol-implementation bug waiting to reproduce across every framework that adopts the same specs. LangGraph, CrewAI, AutoGen, Semantic Kernel โ same exposure class, same "we'll harden later" energy.
Hype is fuel. Liquidity is the engine. Security is the chassis, and the chassis is cracking.
Forward, not backward. The signal to trade here isn't a token โ it's a category. Agent identity and security governance is moving from a footnote to a line item: agent IAM, agent-to-agent zero trust, MCP/A2A gateways, agent behavior audit. Watch it in the next funding cycle.
For operators: audit every orchestrator you run for fail-open auth defaults, then verify your MCP/A2A endpoints against SSRF. Do it before someone does it for you.
Speed is the only alpha that doesn't decay. Everything else โ including your cloud account โ waits for no one.
