CVE-2026-112407: Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS CICD-toolchain-for-serverless-applicationsto a version that resolves this vulnerability.Fixed in 1.0.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with push access to the application source repository can exploit it. The issue affects users able to submit application templates that the toolchain pipeline deploys.
What resources could be affected?
A successful exploit can let the attacker escalate privileges and access or modify resources outside the application stack, as long as those resources are in the same AWS account.
Which versions require remediation?
AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10 are affected. Upgrade existing toolchain stacks to version 1.0.11 or later.