key,summary,details,category,agent,requester_email,team,sla,priority,parent_key,asset_keys,target_date,CFPOAMID,CFIsPOAM,CFWeaknessDescription,CFCVE,CFCVSSBaseScore,CFOriginalRiskRating,CFAdjustedRiskRating,CFPotentialAdverseImpact,CFInternetReachable,CFLikelyExploitable,CFFalsePositive,CFRiskAdjustment,CFOperationalRequirement,CFAssetIdentifier,CFPort,CFServiceName,CFWeaknessDetectorSource,CFWeaknessSourceIdentifier,CFResults,CFSuggestedSolution,CFOverallRemediationPlan,CFPlannedMilestones,CFMilestoneChanges,CFStatusDate,CFResourcesRequired,CFPointofContact,CFVendorDependency,CFVendorDependentProductName,CFLastVendorCheckinDate,CFDeviationRationale,CFSupportingDocuments,CFIssueComments,CFAutoApprove,CFBODTracking,CFBODDate,CFEvaluationCompletedAt
iss-resshion,regreSSHion,"Umbrella for the OpenSSH signal-handler race affecting glibc-based Linux hosts in the workload account. Remote code execution as root is possible in principle; inbound SSH is not exposed and administrative access is mediated by SSM Session Manager, so exposure is limited to lateral paths inside the private subnets.",Continuous Monitoring>Vulnerability>Operating System,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN4: LEV+NIRV,,,2026-09-04,,Yes,Signal handler race condition in OpenSSH sshd permits unauthenticated remote code execution as root on glibc-based Linux.,CVE-2024-6387,8.1,High,PAIN4: LEV+NIRV,PAIN4,No,Yes,,,,,,,Tenable Nessus,nessus-plugin-201195,,Upgrade OpenSSH to 9.8p1 or later on all affected hosts; confirm sshd version via the configuration baseline scan after patching.,"Patch both affected hosts in the September routine patch window, then re-scan to confirm the version moved past 9.8p1.",,,,,,,,,,,,,,,
iss-resshion-web,regreSSHion - DEMO-AWS-WEB-NGINX,Web tier host (Ubuntu 22.04) running an affected OpenSSH build. Reachable only from the management tier over the private subnet boundary.,Continuous Monitoring>Vulnerability>Operating System,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN4: LEV+NIRV,iss-resshion,web,2026-09-04,,Yes,,CVE-2024-6387,8.1,High,PAIN4: LEV+NIRV,PAIN4,No,Yes,,,,DEMO-AWS-WEB-NGINX,22,OpenSSH,Tenable Nessus,,sshd version banner reports an affected release; host is domain-joined and reachable from the management tier only.,,,,,,,,,,,,,,,,,
iss-resshion-app,regreSSHion - DEMO-AWS-APP-SPRINGBOOT,Application tier host (Amazon Linux 2023) running an affected OpenSSH build.,Continuous Monitoring>Vulnerability>Operating System,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN4: LEV+NIRV,iss-resshion,app,2026-09-04,,Yes,,CVE-2024-6387,8.1,High,PAIN4: LEV+NIRV,PAIN4,No,Yes,,,,DEMO-AWS-APP-SPRINGBOOT,22,OpenSSH,Tenable Nessus,,,,,,,,,,,,,,,,,,,
iss-spring4shell,Spring4Shell,"Remote code execution in the Spring Framework data-binding path on the application tier, reachable from the internet through the public application load balancer. Deliberately left on the runbook trigger path: PAIN5 with likely exploitability and internet reachability drives PAIN5: LEV+IRV, which auto-creates an Incident.",Continuous Monitoring>Vulnerability>Code,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN5: LEV+IRV,,app;alb,2026-08-08,,Yes,Class-loader access via request data binding permits remote code execution on affected Spring Framework versions running on JDK 9 or later.,CVE-2022-22965,9.8,Critical,PAIN5: LEV+IRV,PAIN5,Yes,Yes,,,,DEMO-AWS-APP-SPRINGBOOT,,,Wiz,,Dependency scan flags an affected Spring Framework version in the deployed application image; endpoint is exposed through the public load balancer.,Upgrade Spring Framework to a patched release and redeploy the application container; add a temporary request-pattern deny rule at the WAF until the rollout completes.,"Emergency change: patched container image built and promoted through the pipeline, WAF rule applied as an interim compensating control.",,,,,,,,,,,,,,,
iss-leakyvessels,Leaky Vessels,Container escape in the runc file-descriptor handling used by the EKS node groups. Exploitation requires the ability to run a crafted container image.,Continuous Monitoring>Vulnerability>Container,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN3: LEV+NIRV,,inference;workers,2026-09-18,,Yes,A leaked file descriptor in runc allows a crafted container to obtain a handle to the host filesystem and escape isolation.,CVE-2024-21626,8.6,High,PAIN3: LEV+NIRV,PAIN3,No,Yes,,,,,,,Trivy,,,Update the node group AMI to a runc release past 1.1.12 and recycle the nodes; registry immutability and image signing limit the ability to introduce a crafted image.,,,,,,,Yes,AWS EKS optimized AMI,,,,,,,,
iss-text4shell,Text4Shell,Variable interpolation in Apache Commons Text permits code execution when untrusted input reaches the interpolator. The affected library is a transitive dependency of the document-processing worker.,Continuous Monitoring>Vulnerability>Code,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN3: NLEV,,workers,2026-10-02,,Yes,"String interpolation in Apache Commons Text evaluates lookup expressions, permitting code execution where untrusted input reaches the interpolator.",CVE-2022-42889,9.8,High,PAIN3: NLEV,PAIN3,No,No,,,,,,,Snyk,,,Upgrade Apache Commons Text to 1.10.0 or later. Code review confirms no untrusted input path reaches the interpolator in current usage.,,,,,,,Yes,document-processing worker upstream library,,,,,,,,
iss-unauth-api,Unauthenticated inference endpoint exposure,"A diagnostic inference endpoint responds without an authorization header, returning model metadata and version detail. No customer content or embedding data is exposed.",Continuous Monitoring>Vulnerability>Web Application,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN2: LEV+IRV,,alb;app,2026-09-11,,Yes,"A diagnostic endpoint is reachable without authentication and discloses model name, version, and configuration metadata.",,6.5,Moderate,PAIN2: LEV+IRV,PAIN2,Yes,Yes,,,,,,,OWASP ZAP,,Automated scan received a 200 response with a metadata document on an unauthenticated request.,Require the standard bearer-token filter on the diagnostic route and add a regression test asserting a 401 for unauthenticated requests.,,,,,,,,,,,,,,,,
iss-sg-open,Security group permits unrestricted management ingress,"A security group attached to the management tier permits inbound tcp/22 from 0.0.0.0/0. The subnet network ACL denies the traffic, so the effective path is closed, but the group itself violates the documented default-deny baseline.",Continuous Monitoring>Misconfiguration>Network Device,Demo Account,,Continuous Monitoring,Class C Remediation SLA,PAIN2: NLEV,,bastion,2026-09-25,,Yes,"Security group rule allows inbound tcp/22 from any source, contrary to the default-deny tier boundary described in the network architecture.",,,Moderate,PAIN2: NLEV,PAIN2,No,No,,,,,,,Steampipe Powerpipe,,Benchmark control for unrestricted SSH ingress returned a failing row for the management-tier security group.,Remove the rule; administrative access is already mediated by SSM Session Manager and requires no inbound SSH.,,,,,,,,,,,,,,,,
