CVE-2026-112407CWE-266

CVE-2026-112407

High · published October 21, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.

To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-10-21T01:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-141-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 20 OCT 20:34Z
    Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
    cvelistv5
  • 20 OCT 20:34Z
    Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
    cvelistv5