{"id":"CVE-2026-112407","kind":"vulnerability","aliases":["CVE-2026-112407"],"related":[],"title":"AWS CICD toolchain for serverless: IAM policy lets repo writers escalate in account","description":"CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications\n\n### CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications\n\nBulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT\n\nDescription:\n\nCICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications before 1.0.11 that allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\nImpacted versions: =1.0.7 AND <=1.0.10\n\nResolution:\n\nThis issue has been addressed in CICD-toolchain-for-serverless-applications version 1.0.11. We recommend upgrading existing toolchain stacks to version 1.0.11 or later and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-112407\n- GHSA-f76m-4xrx-pvq5\n\nAcknowledgement:\n\nWe would like to thank Changli from Xidian University for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The CloudFormation deployment role created by AWS's CICD-toolchain-for-serverless-applications (an aws-samples project) had IAM, Secrets Manager and SSM Parameter Store write permissions that were not scoped to the app. Anyone with push access to the app repo can commit a template that the pipeline deploys, and that template can act on IAM identities, secrets and parameters elsewhere in the same AWS account. No cross-account impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CICD-toolchain-for-serverless-applications","fixed":["1.0.11"],"affected":">= 1.0.7, <= 1.0.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aws","ci-cd","iam","infrastructure","lab-disclosure","privilege-escalation","self-hosted","serverless"],"not_affected_if":["no-push-access-untrusted-users","no-toolchain-stack","version-1.0.11-or-later"],"how_to_check":"In CloudFormation, find stacks deployed from CICD-toolchain-for-serverless-applications and check the template or release version. Versions 1.0.7 to 1.0.10 are affected; the GHSA lists everything before 1.0.11. Then open the stack's CloudFormation deployment role in IAM. If its IAM role-policy write actions have no permissions-boundary condition, or its Secrets Manager and SSM write actions apply to all resources instead of the app's own, it is the unfixed policy. Also check any forks you made of the toolchain.","fix":"Update existing toolchain stacks to release 1.0.11 or later (fix commit fa3aa2b, PR #27). It gates IAM role-policy writes behind a permissions boundary and scopes Secrets Manager and SSM Parameter Store writes to the app's own resources. Until you have upgraded, limit who can push to the app repos and review the secrets, parameters and IAM changes made through the pipeline.","status":"open","published_at":"2026-10-20T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:32:47+00:00","updated_at":"2026-10-24T19:43:42+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade existing toolchain stacks to version 1.0.11 or later.","reach":"network","title":"AWS CICD toolchain for serverless: IAM policy lets repo writers escalate in account","impact":"high","summary":"Versions 1.0.7 through 1.0.10 of AWS's CI/CD toolchain for serverless applications grant the deployment IAM policy too much access. A user with push access to the application repository can use the pipeline to reach and change AWS resources outside the app's stack in the same account.","category":"infrastructure","who_cares":["aws","serverless","ci-cd","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with repo push access modifies AWS resources outside the app stack","analyst_note":"Check the AWS security bulletin or the project's release notes at the NVD link to confirm the affected template and how to inspect the deployed IAM role.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-1.0.11-or-later","no-toolchain-stack"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2974,"output_tokens":405,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the AWS security bulletin or the project's release notes at the NVD link to confirm the affected template and how to inspect the deployed IAM role.","search":"'-112407':16A,19A,118C,132C,193C,304C '-141':147C '-2026':15A,18A,117C,131C,192C,303C '1.0.10':254C '1.0.11':211C,269C,278C '1.0.7':252C '10/20/2026':158C '13':159C '2026':146C '30':160C '4xrx':308C 'access':81B,219C,229C 'account':13A,110B,114B,241C 'acknowledg':310C 'act':98B 'address':260C 'allow':213C 'anyon':78B 'app':77B,84B 'applic':55B,129C,143C,169C,174C,182C,187C,209C,222C,235C,243C,267C 'applications':25A 'assign':121C,135C,197C 'attent':155C 'authent':215C 'avail':300C 'aw':1A,26B,48B,58B,109B,123C,137C,148C,150C,172C,185C,203C,240C 'aws-sampl':57B 'aws-security@amazon.com':333C 'bulletin':144C 'cd':29B 'chang':316C 'ci':28B 'ci-cd':27B 'ci/cd':178C 'cicd':2A,21A,51B,125C,139C,165C,205C,263C 'cicd-toolchain-for-serverless-appl':50B,124C,138C,164C,204C,262C 'cicd-toolchain-for-serverless-applications':20A 'cloudform':43B 'code':287C 'collabor':321C 'commit':87B 'concern':339C 'content':151C 'coordin':327C 'creat':46B 'cross':113B 'cross-account':112B 'cve':14A,17A,116C,130C,191C,302C 'date':157C 'deploy':44B,93B,245C 'deriv':286C 'descript':163C 'disclosur':34B,329C 'elsewher':105B 'email':332C 'ensur':282C 'escal':11A,37B,226C 'exist':273C 'f76m':307C 'fix':294C 'for':23A 'fork':284C 'ghsa':306C 'ghsa-f76m-4xrx-pvq5':305C 'host':40B 'iam':6A,30B,62B,100B,200C 'id':145C 'ident':101B 'identifi':190C 'impact':115B,250C 'import':153C 'incorpor':291C 'incorrect':119C,133C,195C 'infrastructur':31B 'issu':257C,324C 'lab':33B 'lab-disclosur':32B 'later':280C 'let':8A 'like':313C 'manag':64B 'modifi':231C 'new':293C 'outsid':233C 'paramet':67B,104B 'patch':289C 'pdt':162C 'permiss':70B 'pipelin':92B,179C,249C 'pleas':331C 'pm':161C 'polici':7A,201C 'privileg':36B,120C,134C,196C,227C 'privilege-escal':35B 'process':330C 'project':60B 'provis':176C 'public':156C 'push':80B,218C 'pvq5':309C 'question':337C 'recommend':271C 'refer':301C 'remot':214C 'repo':9A,85B 'repositori':188C,224C 'requir':154C 'resolut':255C 'resourc':232C 'role':45B 'sampl':59B,173C 'scope':74B,149C 'secret':63B,102B 'secur':336C 'self':39B 'self-host':38B 'serverless':5A,24A,41B,54B,128C,142C,168C,181C,186C,208C,266C 'sourc':223C 'ssm':66B 'stack':236C,275C 'store':68B 'templat':89B,96B,244C 'thank':315C 'toolchain':3A,22A,52B,126C,140C,166C,206C,248C,264C,274C 'type':152C 'univers':319C 'upgrad':272C 'user':216C 'version':251C,268C,277C 'via':242C 'vulner':328C 'workaround':295C,299C 'would':312C 'write':69B 'writer':10A 'xidian':318C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112407","severity":null,"published_at":"2026-10-20T21:17:17+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112407:606","url":null,"severity":null,"published_at":"2026-10-24T00:11:34+00:00","modified_at":"2026-10-24T00:11:34+00:00","first_seen_at":"2026-10-24T00:11:34+00:00","fetched_at":"2026-10-24T00:11:34+00:00","note":"Read GHSA-f76m-4xrx-pvq5 (aws-samples/aws-lambda-sample-applications) and 1.0.11 release notes. GHSA says affected <1.0.11, CVE says 1.0.7-1.0.10. Not exploited as far as sources say. No public PoC beyond the advisory's prose description. Skipped X search because this is a niche sample app."},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-141-aws/#CVE-2026-112407","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-141-aws/","severity":null,"published_at":"2026-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:43:42+00:00","fetched_at":"2026-10-24T19:43:42+00:00","note":"AWS: CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications"}],"documents":[{"id":2472,"url":"https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5","title":"GHSA-f76m-4xrx-pvq5: Incorrect privilege assignment in CICD-toolchain-for-serverless-applications","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2473,"url":"https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11","title":"CICD-toolchain 1.0.11 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2959,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-141-aws/","title":"AWS: CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications","kind":"advisory","source":"lab","text":"CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications\n\n### CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications\n\nBulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT\n\nDescription:\n\nCICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications before 1.0.11 that allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.\n\nImpacted versions: =1.0.7 AND <=1.0.10\n\nResolution:\n\nThis issue has been addressed in CICD-toolchain-for-serverless-applications version 1.0.11. We recommend upgrading existing toolchain stacks to version 1.0.11 or later and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround available.\n\nReferences:\n\n- CVE-2026-112407\n- GHSA-f76m-4xrx-pvq5\n\nAcknowledgement:\n\nWe would like to thank Changli from Xidian University for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-20T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}