InfoSecBulletin Cybersecurity for mankind
Security researchers disclosed a cirtical flaw in Amazon Elastic Container Service (ECS) that enables harmful containers to steal AWS credentials from other tasks on the same EC2 instance.
The attack, dubbed “ECScape,” exploits an undocumented internal protocol to impersonate the ECS agent and harvest privileged credentials without requiring container breakout.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
Vulnerability Overview:
The ECScape attack takes advantage of a basic mistake in how ECS handles IAM credentials on shared EC2 instances.
Running multiple containers with varying privilege levels on the same host can lead to security risks. A low-privileged container could exploit the ECS Agent Communication Service (ACS) protocol to access credentials from higher-privileged tasks.
The vulnerability was discovered by security researcher Naor Haziz during development of an eBPF-based monitoring tool.
While investigating how ECS tasks retrieve metadata, Haziz observed that the ECS agent receives task credentials via a WebSocket connection to AWS’s control plane with a suspicious “sendCredentials=true” parameter.
AWS advises ECS users to take protective measures. Key strategies include not deploying high-privilege tasks with untrusted containers on shared instances, using dedicated hosts for critical services, or switching to AWS Fargate for isolated task environments.
Additional protections involve restricting IMDS access through the ECS_AWSVPC_BLOCK_IMDS setting, enforcing IMDSv2, and implementing least-privilege IAM policies.
Organizations should remove unnecessary Linux capabilities to reduce post-compromise risks.
The disclosure emphasizes key security aspects of container orchestration platforms and the need to grasp isolation boundaries in cloud environments.
While AWS has not indicated plans to modify the underlying architecture, the research emphasizes why Fargate’s micro-VM isolation provides stronger security guarantees for sensitive workloads.
