GCVE-110-CLOUD-2025-0025

Advisory Published

Vulnetix · Advisory published January 16, 2025

A vulnerability in AWS CloudWatch dashboard sharing allowed viewers to access EC2 instance tags and potentially invoke Lambda functions in the source account. The issue stemmed from a logic bug in the AWS Console combined with a "fail open" condition in Amazon Cognito. AWS has since patched the vulnerability.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
AWS	CloudWatch, Cognito, EC2, Lambda	—	—

References

CloudWatch Dashboard Sharing Exposes EC2 Tags

advisory

Browse GCVE Records

74,496 records in the GCVE database · Updated July 23, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON