Live › vulnerability › CVE-2026-112407
Go to dashboardThe CloudFormation deployment role created by AWS's CICD-toolchain-for-serverless-applications (an aws-samples project) had IAM, Secrets Manager and SSM Parameter Store write permissions that were not scoped to the app. Anyone with push access to the app repo can commit a template that the pipeline deploys, and that template can act on IAM identities, secrets and parameters elsewhere in the same AWS account. No cross-account impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| CICD-toolchain-for-serverless-applications | vendor | >= 1.0.7, <= 1.0.10 | 1.0.11 |
1.0.7 to 1.0.10 are affected; the GHSA lists everything before 1.0.111.0.11 or later (fix commit fa3aa2b, PR #27)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
Bulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT
Description:
CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications before 1.0.11 that allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
Impacted versions: =1.0.7 AND <=1.0.10
Resolution:
This issue has been addressed in CICD-toolchain-for-serverless-applications version 1.0.11. We recommend upgrading existing toolchain stacks to version 1.0.11 or later and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround available.
References:
Acknowledgement:
We would like to thank Changli from Xidian University for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-112407")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.