High severity · published Oct 20, 2026
CVE-2026-112407
Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
CICD-toolchain-for-serverless-applications · AWS
1.0.7 through 1.0.10 · source: vendor
Affected product
CI
CICD-toolchain-for-serverless-applications
AWS
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112407
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-141-aws/
github.com
https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11
github.com
https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5