---
id: "CVE-2026-86830"
kind: "vulnerability"
aliases: ["CVE-2026-86830"]
title: "AWS TEAM: authenticated users gain unintended elevated access to accounts"
severity: "high"
cvss: 8.6
epss: 0.0069
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "iam-identity-center", "infrastructure", "lab-disclosure", "self-hosted"]
not_affected_if: ["not-using-team"]
published_at: "2026-09-14T00:00:00+00:00"
first_seen_at: "2026-10-24T19:12:58+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/", "first_seen_at": "2026-10-24T19:12:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86830", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-86830", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# AWS TEAM: authenticated users gain unintended elevated access to accounts

TEAM is an open source AWS sample solution for granting temporary elevated access through IAM Identity Center. An authenticated user with application-level access can obtain elevated temporary access to AWS accounts that TEAM manages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed TEAM version; versions below `1.5.1` are affected.
- Review TEAM-managed permission sets and account assignments for roles a basic application user should not hold.
- Check any forked or derivative TEAM code for the same privilege assignment logic.

## Fix

- Upgrade TEAM to `1.5.1` or later.
- Patch any forked or derivative code with the upstream fix, per AWS guidance.
- No workaround is documented.

## Timeline

- 2026-10-24T19:12:58+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/ — AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86830
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-86830

## Documents

- [advisory] AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/

## From the sources

CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Bulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT

Description:

Temporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.

Impacted versions: <1.5.1

Resolution:

This issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

None.

References:

- CVE-2026-86830
- GHSA-6x87-mjv8-mgvj

Acknowledgement:

We would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_