Live › vulnerability › CVE-2026-86830
Go to dashboardTEAM is an open source AWS sample solution for granting temporary elevated access through IAM Identity Center. An authenticated user with application-level access can obtain elevated temporary access to AWS accounts that TEAM manages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC, 0h before NVD. All times on this page are UTC.
Teams running the AWS TEAM sample solution with IAM Identity Center for temporary elevated access, at versions below 1.5.1, and any forks of it. Exposure depends on users with application-level access, who could use the flaw to reach elevated permissions in managed AWS accounts. Teams not running TEAM are not affected.
No product ranges from the sources yet.
1.5.1 are affected.1.5.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Bulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT
Description:
Temporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.
Impacted versions: <1.5.1
Resolution:
This issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
None.
References:
Acknowledgement:
We would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-86830")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.