CVE-2026-112407

Published: Ott 20, 2026 Last Modified: Ott 20, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,7

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

HIGH 8,8

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

Description

AI Translation Available

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.

To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

266

Incorrect Privilege Assignment

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Access Control

Potential Impacts:

Gain Privileges Or Assume Identity

Applicable Platforms

All platforms may be affected

View CWE Details

https://aws.amazon.com/security/security-bulletins/2026-141…

https://aws.amazon.com/security/security-bulletins/2026-141-aws/

https://github.com/aws-samples/aws-lambda-sample-applicatio…

https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.…