CVE-2026-105811

Name of the Vulnerable Software and Affected Versions QnABot on AWS versions 7.0.0 through 7.4.5

Description An authorization bypass exists in the optional Amazon Q Business Lambda hook sample. This issue occurs due to a user-controlled key, which may allow an authenticated remote user to read arbitrary Amazon S3 objects within the deploying AWS account. This sample solution requires separate, manual deployment and additional setup, as it is not automatically deployed with the main software.

Recommendations Update the QnABot on AWS stack to version 7.4.6 or later and redeploy the Amazon Q Business Lambda hook sample stack.