CVE-2026-94384: Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation.
To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amazon-connect-salesforce-lambdato a version that resolves this vulnerability.Fixed in 5.26 - Configuration
After setup is complete, disable sfExecuteAWSService; alternatively, delete the function.
sfExecuteAWSService Lambda function enabled = false - Compensating control
If sfExecuteAWSService is retained, restrict invocation to the intended IAM user only.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any IAM principal that has lambda:InvokeFunction permission on the affected sfExecuteAWSService function can exploit it. The caller does not need IAM permission for the AWS API operations performed through the function.
Are deployments using the default configuration affected?
No. The sfExecuteAWSService function is disabled by default.
What should be done if the function is not required?
After upgrading to version 5.26 or later, delete or disable sfExecuteAWSService. This removes the exposed dispatcher.
What mitigation is available if sfExecuteAWSService must be retained?
Restrict invocation of the function to the intended IAM user only. Do not allow other IAM principals to invoke it.