What’s Vulnerable › Vulnerabilities

CVE-2026-112407: Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-28
• Weakness: CWE-266

Description

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

Affected products

• AWS CICD-toolchain-for-serverless-applications: from 1.0.7 through 1.0.10

References

• https://aws.amazon.com/security/security-bulletins/2026-141-aws/
• https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11
• https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5

Get alerted when CVE-2026-112407 or the next vulnerability affects your stack