{"id":"CVE-2026-86830","kind":"vulnerability","aliases":["CVE-2026-86830"],"related":[],"title":"AWS TEAM: authenticated users gain unintended elevated access to accounts","description":"CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\n### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\nBulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT\n\nDescription:\n\nTemporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.\n\nImpacted versions: <1.5.1\n\nResolution:\n\nThis issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-86830\n- GHSA-6x87-mjv8-mgvj\n\nAcknowledgement:\n\nWe would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"TEAM is an open source AWS sample solution for granting temporary elevated access through IAM Identity Center. An authenticated user with application-level access can obtain elevated temporary access to AWS accounts that TEAM manages.","severity":"high","cvss":8.6,"epss":0.0069,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","iam-identity-center","infrastructure","lab-disclosure","self-hosted"],"not_affected_if":["not-using-team"],"how_to_check":"- Check the deployed TEAM version; versions below `1.5.1` are affected.\n- Review TEAM-managed permission sets and account assignments for roles a basic application user should not hold.\n- Check any forked or derivative TEAM code for the same privilege assignment logic.","fix":"- Upgrade TEAM to `1.5.1` or later.\n- Patch any forked or derivative code with the upstream fix, per AWS guidance.\n- No workaround is documented.","status":"open","published_at":"2026-09-14T00:00:00+00:00","first_seen_at":"2026-10-24T19:12:58+00:00","triaged_at":"2026-10-25T05:29:35+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T05:29:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TEAM to `1.5.1` or later.\n- Patch any forked or derivative code with the upstream fix, per AWS guidance.\n- No workaround is documented.","reach":"network","title":"AWS TEAM: authenticated users gain unintended elevated access to accounts","impact":"high","summary":"TEAM is an open source AWS sample solution for granting temporary elevated access through IAM Identity Center. An authenticated user with application-level access can obtain elevated temporary access to AWS accounts that TEAM manages.","category":"infrastructure","nicknames":[],"who_cares":["aws","iam-identity-center","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated users obtain unintended elevated access to managed AWS accounts","analyst_note":"","how_to_check":"- Check the deployed TEAM version; versions below `1.5.1` are affected.\n- Review TEAM-managed permission sets and account assignments for roles a basic application user should not hold.\n- Check any forked or derivative TEAM code for the same privilege assignment logic.","needs_analyst":false,"not_affected_if":["not-using-team"],"who_is_affected":"Teams running the AWS TEAM sample solution with IAM Identity Center for temporary elevated access, at versions below 1.5.1, and any forks of it. Exposure depends on users with application-level access, who could use the flaw to reach elevated permissions in managed AWS accounts. Teams not running TEAM are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3820,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112':102C '-2026':12A,15A,66C,83C,144C,205C '-86830':13A,16A,67C,84C,145C,206C '09/14/2026':113C '1.5.1':169C,179C '10':114C '2026':101C '45':115C '6x87':209C 'access':8A,41B,53B,58B,74C,91C,121C,135C,154C,160C 'account':10A,61B,163C 'acknowledg':212C 'address':175C 'ai':222C 'applic':51B,152C 'application-level':50B,151C 'assign':70C,87C 'attent':110C 'authent':3A,47B,148C 'aw':1A,17B,34B,60B,78C,95C,103C,105C,128C,137C,162C 'aws-security@amazon.com':236C 'bulletin':99C 'center':21B,45B,81C,98C,140C 'code':193C 'collabor':224C 'concern':242C 'content':106C 'coordin':230C 'could':155C 'cujo':221C 'cve':11A,14A,65C,82C,143C,204C 'date':112C 'deriv':192C 'descript':118C 'disclosur':25B,232C 'elev':7A,40B,56B,73C,90C,120C,134C,159C 'email':235C 'ensur':188C 'fix':200C 'fork':190C 'gain':5A,156C 'ghsa':208C 'ghsa-6x87-mjv8-mgvj':207C 'grant':38B 'host':28B 'iam':19B,43B,79C,96C,138C 'iam-identity-cent':18B 'id':100C 'ident':20B,44B,80C,97C,139C 'identifi':142C 'impact':167C 'import':108C 'incorpor':197C 'incorrect':68C,85C 'infrastructur':22B 'issu':172C,227C 'jani':218C 'lab':24B 'lab-disclosur':23B 'latest':185C 'level':52B,153C 'like':215C 'manag':64B,75C,92C,122C,132C,164C 'mgvj':211C 'mjv8':210C 'muuriaisniemi':219C 'new':199C 'none':202C 'obtain':55B 'open':32B,126C 'patch':195C 'pdt':117C 'pleas':234C 'privileg':69C,86C 'process':233C 'public':111C 'question':240C 'recommend':181C 'refer':203C 'requir':109C 'resolut':170C 'sampl':35B,129C 'scope':104C 'secur':239C 'self':27B 'self-host':26B 'solut':36B,130C 'sourc':33B,127C 'team':2A,29B,63B,76C,93C,123C,166C,177C 'temporari':39B,57B,72C,89C,119C,133C,158C 'thank':217C 'type':107C 'unintend':6A,157C 'upgrad':182C 'user':4A,48B,149C 'version':168C,178C,186C 'via':136C 'vulner':231C 'workaround':201C 'would':214C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AWS TEAM sample solution with IAM Identity Center for temporary elevated access, at versions below 1.5.1, and any forks of it. Exposure depends on users with application-level access, who could use the flaw to reach elevated permissions in managed AWS accounts. Teams not running TEAM are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-14T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/#CVE-2026-86830","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/","severity":null,"published_at":"2026-09-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T19:12:58+00:00","note":"AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center"},{"source":"nvd","external_id":"CVE-2026-86830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86830","severity":null,"published_at":"2026-09-14T19:17:52+00:00","modified_at":"2026-10-20T19:19:08+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86830","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86830","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2931,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/","title":"AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center","kind":"advisory","source":"lab","text":"CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\n### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\nBulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT\n\nDescription:\n\nTemporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.\n\nImpacted versions: <1.5.1\n\nResolution:\n\nThis issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-86830\n- GHSA-6x87-mjv8-mgvj\n\nAcknowledgement:\n\nWe would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-14T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}