CVE-2026-18481

highCVSS 7.3covered by 1 sourcefirst seen 2026-07-31

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

⚡ Watch CVE-2026-18481

Get an email if CVE-2026-18481 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-18481: Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 mi…nvd · 2026-07-31

External references

NVD record for CVE-2026-18481

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-18481 status](https://www.csirts.com/badge/CVE-2026-18481)](https://www.csirts.com/cve/CVE-2026-18481)