AWS Patches SDK Flaw That Let A Region Field Steal Credentials

Picture typing something as harmless as a region name into a text box, and that single field quietly handing your cloud credentials to a stranger. That is essentially what happened inside seven of Amazon’s own software development kits, and the story behind how it was found is just as interesting as the bug itself.

In this article, we will look at what the flaw actually was, how a tiny piece of unchecked input turned into a credential leak, how researchers found it hiding across hundreds of services, and what Amazon has done about it since.

How a harmless looking field became a trap

Every AWS SDK builds the web address it calls using a simple template, with the region slotted into the middle of something like https colon slash slash service dot region dot amazonaws dot com. A normal region looks like us east 1. The problem was that on several vulnerable code paths, nothing actually checked whether the region value was normal at all.

Researchers at product security startup Pi Inc tested this by feeding the region field a value designed to look like part of a web address, using the at symbol and a hash symbol as separators. Because of how web address parsers work, anything before the at symbol gets read as a username, and anything after the hash symbol gets ignored entirely. What is left over is the attacker’s own domain, meaning the SDK unknowingly signed and sent a request straight to a server the researchers controlled.

Why this was more than a curiosity

By rerouting a standard API request in this manner, an authentication signature is exposed, which isn’t ideal but can usually be tolerated on its own. The true threat comes from a specific function known as AssumeRoleWithWebIdentity, used in workloads utilizing Elastic Kubernetes Service, Cognito, and OpenID Connect. This particular function does contain a bearer token in plain text in its body.

Through one authorized experiment, the experts rerouted this specific function from within a workload on EKS. The leaked token belonged to a Kubernetes service account of the pod, and after that token was used in AWS Security Token Service, it produced effective working credentials of the target’s own AWS account.

How one bug report turned into 2500 findings

What makes this story remarkable is the method that Pi’s research team adopted in discovering the flaw. Instead of developing separate detection rules for each programming language, or reviewing each service one by one, they implemented the discovery in their system by feeding it the original bug report with no other information. This provided the system with a non-specific description of the bug itself, which has been referred to as “anti-pattern,” so that the system could look for it everywhere.

AWS creates SDK clients for over 400 services from a common set of service models, which means that if there is one missing validation step in the generator, this will affect all the subsequent SDK clients created based on that generator. This is true for python and ruby, which had had protections against it for many years. However, since others SDKs lacked protection, this gap ultimately manifested itself in more than 2500 cases of this very defect.

The fix was small, the rollout was not

The actual fix involves a simple implementation of a patch that requires ensuring that your region is a valid hostname consisting of a combination of letters, numbers, and hyphens before reaching to the hostname itself, which is done inside the SDK code. Because the validation logic is implemented independently inside each SDK code block, AWS had to implement the fix seven times.

The issue was reported by Pi in October 2025 and the first patch was issued within a week afterward. Public warnings were issued in January, with the Go SDK 2 bearing the last warning. Only the dot NET SDK received a CVE and its severity was determined to be low. AWS has stated that its new implementation is an improvement of its policy rather than fixing of a vulnerability due to its special model of distribution of responsibilities.

Pi disagrees with how narrowly this was scored, arguing that a single instance rating cannot capture a class of flawed behavior that a code generator has copied into thousands of client libraries. To make its point, the company tested the flaw against seven third-party platforms that embed an AWS SDK and expose a region field to users. All seven were exploitable, and every one leaked live AWS credentials to a callback server the researchers controlled.

What this means for anyone running on AWS

If your applications let users select an AWS region anywhere in the request path, it is worth checking which SDK version you are running and whether that input gets validated before use. This kind of flaw is a reminder that even the smallest, most routine-looking fields deserve scrutiny, especially when they end up inside a URL your own backend trusts. Review your SDK versions today rather than waiting for the next advisory to remind you.