// Security Advisory Triage
AWS removed CVE-2026-7191 QnABot security bulletin entirely
AWS security bulletins · published 2026-09-24 19:12 UTC
CORRECTED 2026-09-24 22:33 UTC — Correction: AWS did not withdraw this bulletin. The bulletin page is still live and lists the same CVEs. AWS's feed stopped including the bulletin text on 24 Sep, and RADAR misread that as a removal. The rule that caused this is fixed.
Stood 3h 21m · cause source changed format · every correction ↗
WHAT CHANGEDAWS Security Bulletin 2026-020-AWS, published 27 April 2026, was completely removed on 24 September 2026. The bulletin documented CVE-2026-7191, an arbitrary code execution vulnerability in QnABot on AWS versions ≤7.2.4 affecting authenticated administrators. All technical details including exploitation method, affected components (Lambda, OpenSearch, S3, DynamoDB), and version scope were deleted.
WHY IT MATTERSIf you are running QnABot ≤7.2.4 and acted on the original bulletin, you no longer have AWS's published guidance. If you did not act, you cannot now determine whether you are exposed or what to do. The removal provides no explanation—whether the CVE was withdrawn, the scope changed, or AWS is retracting the advisory.
WHAT TO DOCheck your QnABot version immediately. If ≤7.2.4, search CVE-2026-7191 in NIST NVD and vendor changelogs to determine current status. If you applied mitigations based on the original bulletin, verify they are still appropriate. Contact AWS Support for clarification if QnABot is in production.
Model-reported confidence 95% (not measured accuracy)
Primary source ↗
written by anthropic/claude-sonnet-4.5
Show the reasoning — raw diff, triage verdict, confidence
RAW DIFF
## CVE-2026-7191- Arbitrary Code Execution via Sandbox Bypass in QnABot on AWS https://aws.amazon.com/security/security-bulletins/rss/2026-020-aws/ -Wed, 09 Sep 2026 21:30:11 +0000 - -Bulletin ID: 2026-020-AWS - -Scope: AWS - -Content Type: Important (requires attention) - -Publication Date: 2026/04/27 13:15 PM PDT -Description: -QnABot on AWS is an open-source solution that provides a multi-channel, multi-language conversational interface powered by Amazon Lex, Amazon OpenSearch Service, and optionally Amazon Bedrock. -We identified CVE-2026-7191, where the improper use of the static-eval npm package may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. By injecting a crafted conditional chaining expression via the Content Designer interface, an actor with Admin access could bypass the intended expression sandbox through JavaScript prototype manipulation. Successful exploitation may grant direct access to backend resources, including Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables, that are not exposed through normal administrative interfaces. -Impacted versions: <=7.2.4 -Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. +Thu, 24 Sep 2026 17:49:07 +0000
HOW IT WAS JUDGED
Triage signals below are model-reported assertions, preserved verbatim; they are not independent arithmetic verification.
| triage verdict | MATERIAL at 0.92, needed 0.55 |
|---|---|
| triage reasoning | Security advisory content was deleted; readers cannot assess or act on the vulnerability. |
| signals | advisory content removed entirely · CVE severity and scope details deleted · affected versions list removed · exploitation path description removed · impact scope (Lambda, OpenSearch, S3, DynamoDB) removed · publication date changed · bulletin metadata stripped |
| suppression | — |
| triage model | anthropic/claude-haiku-4.5 ($0.00000) |
| writer model | anthropic/claude-sonnet-4.5 ($0.00000) |