Cross-Tenant Metadata Leak in AWS Bedrock via Model Customization Job API
Overview
A medium-severity authorization flaw was identified in the AWS Bedrock service's API for managing model customization jobs. The vulnerability, an Insecure Direct Object Reference (IDOR), allowed an authenticated AWS user to view high-level metadata of fine-tuning jobs belonging to other AWS accounts. The issue was present in the `GetModelCustomizationJob` API call. By crafting a request with a validly formatted but different account's Job ARN (Amazon Resource Name), an attacker could bypass standard tenancy checks. The API response would then leak metadata such as the `jobName`, `outputModelName`, `baseModelArn`, `jobStatus`, `creationTime`, and hyperparameter settings. While this vulnerability did not expose the underlying training data, the model weights themselves, or allow for modification of jobs, the leaked metadata could be sensitive. Attackers could infer the AI strategies of other companies by observing the base models being customized (e.g., Anthropic Claude 3 vs. Cohere Command R+), the frequency of training, and the naming conventions of projects. AWS resolved the issue by enforcing stricter resource-based authorization policies on the backend, ensuring the identity in the request token has explicit permissions for the specific ARN being requested.
Affected Systems
Testing Guide
1. This vulnerability has been patched by AWS. You can test the fix by attempting to call `aws bedrock get-model-customization-job --job-identifier <ARN_from_another_account>` using the AWS CLI. 2. You should receive an `AccessDeniedException`, confirming that the patch is effective and you cannot access resources outside your account's scope.
Mitigation Steps
1. This vulnerability was patched on the server-side by AWS. No customer action is required to fix the vulnerability itself. 2. Review IAM policies for Bedrock to ensure they follow the principle of least privilege, limiting which users can view or create customization jobs. 3. Use non-descriptive, randomized names for model customization jobs to reduce the information leaked in case of future, similar vulnerabilities.
Patch Details
The vulnerability was remediated by the AWS Bedrock service team on November 21, 2025. The fix was deployed globally and requires no action from customers.