One unvalidated region string sent signed AWS API calls to attacker.com

The missing check sat where it was guaranteed to multiply. AWS generates SDK clients for more than 400 services from shared service models ^[6], so an absent validation in the generator is not one bug in one client library. Python and Ruby had guarded the region field for years; most of the rest had not ^[7]. The correction runs to a few lines: validate the region as a host label, letters and digits and hyphens, before it reaches the hostname ^[8]. Because that validation lives inside each generated SDK rather than in one shared place, AWS wrote it seven times ^[9].

Pi reported the bug on Oct. 14, 2025, and a first patch was committed within a week ^[10][11]. The advisories did not go out until Jan. 8 and Jan. 9, with Go v2 last ^[12]. That is about 86 days from report to advisory ^[1], roughly 79 of them with corrected code already in place ^[2]. For anyone maintaining lockfiles, the useful question is per language: did you pick up the commit, or are you still waiting on the advisory to trigger a bump?

The audit itself is narrow enough to do properly. Plenty of applications let a user pick the region ^[18], and that is the entire precondition: a value that arrives from outside and lands in a client constructor. What made the EKS engagement worse than a leaked signature is the call being redirected. AssumeRoleWithWebIdentity carries a bearer token in its body, in plaintext ^[4], so the testers received the pod's Kubernetes service account token and replayed it to STS for live credentials inside the customer's account ^[5]. Any workload sitting behind an OIDC or Cognito trust path has that same shape ^[4].

AWS's advisories describe the change as a defense-in-depth enhancement rather than a vulnerability, and say validating that input is the developer's job under the shared responsibility model ^[14]. That position is defensible and also settles nothing, because the responsibility it assigns is exactly the one the audit above discharges. One CVE exists across the seven patched SDKs ^[3]: .NET's CVE-2026-22611, rated low at 3.7 ^[13], which is what a scanner will surface. Pi, which found the class by handing its own product the single report and letting it search for the behavior rather than the syntax ^[19], says it then tested third-party platforms that embed an AWS SDK and expose the region field, and got live credentials on a callback server from seven of seven ^[15]. Some were security vendors, and all were remediated before publication ^[16]. Pi raised $35 million in June ^[20], so weigh the seven-of-seven accordingly; its narrower point survives the discount, which is that a per-instance score rates one outcome in one place and cannot express a class of behavior a generator has copied into thousands of clients ^[17].