{"id":"CVE-2026-112407","aliases":[],"cve":{"records":[{"id":"CVE-2026-112407","source":"AMZN","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T17:00:34.859Z","published":"2026-10-20T20:34:40.192Z","modified":"2026-10-28T20:04:37.868Z"}],"publishers":[{"name":"AMZN","role":"CNA","organizationId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","modified":"2026-10-20T20:34:40.192Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-28T20:04:37.868Z"}],"references":[{"url":"https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11","tags":["release-notes","patch"],"source":"AMZN"},{"url":"https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5","tags":["third-party-advisory"],"source":"AMZN"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-141-aws/","tags":["vendor-advisory"],"source":"AMZN"}],"weaknesses":[{"id":"CWE-266","description":"CWE-266 Incorrect privilege assignment","source":"AMZN"}],"applicability":[{"source":"AMZN","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aws:cicd-toolchain-for-serverless-applications:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.7","versionEndIncluding":"1.0.10"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T17:53:21.671145Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications","titleSource":"AMZN","descriptionSource":"AMZN","description":"Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\n\n\nTo remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.","score":8.8,"severity":"high","published":"2026-10-20T20:34:40.192Z","modified":"2026-10-28T20:04:37.868Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"AWS","name":"CICD-toolchain-for-serverless-applications","platforms":[],"versions":[{"version":"1.0.7","status":"affected","lessThanOrEqual":"1.0.10","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"AMZN","url":"https://www.cve.org/CVERecord?id=CVE-2026-112407"}],"remediation":[],"references":["https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11","https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5","https://aws.amazon.com/security/security-bulletins/2026-141-aws/"],"sources":[{"name":"CVE","id":"CVE-2026-112407","modified":"2026-10-28T20:04:37.868Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112407"}],"assessments":[{"source":"AMZN","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},{"source":"AMZN","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:30:03.661Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10 have an incorrect privilege assignment weakness, allowing authenticated users with push access to escalate privileges. The impact is access or modification of resources outside the application stack. Users should upgrade to version 1.0.11 or later.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:52:11.422Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112407"}]}}