CVE-2026-112407

CVSS 8.8 (high) · published 2026-10-20

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

Weakness: CWE-266

Source: NVD CVE-2026-112407

References

• https://aws.amazon.com/security/security-bulletins/2026-141-aws/
• https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11
• https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.