CVE-2026-108096: Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Amplify Api ยท 2026-10-09
Actions
Technical Details
| Affected Versions | @aws-amplify/graphql-index-transformer >=2.2.0, <3.1.2; @aws-amplify/graphql-api-construct >=1.4.0, <1.21.4; @aws-amplify/data-construct <1.17.4 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-108096 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update @aws-amplify/graphql-index-transformer to version 3.1.2 and redeploy the backend to address the security vulnerability.
For Platform Teams
Deploy the updated versions of @aws-amplify/graphql-index-transformer, @aws-amplify/graphql-api-construct, and @aws-amplify/data-construct to ensure proper authorization in query resolvers.
For Executives
Implement the latest version of @aws-amplify/graphql-index-transformer to mitigate the security risk of improper authorization in query resolvers.
Source
Related Amplify Api Updates
- AWS Transform now in scope for FedRAMP Class C (2026-08-28)