Live › vulnerability › GHSA-6x87-mjv8-mgvj
Go to dashboardTEAM is an open source AWS sample solution for managing temporary elevated access through IAM Identity Center. An authenticated user with application-level access can gain temporary elevated access to AWS accounts managed by TEAM that they should not have.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC. All times on this page are UTC.
Teams running the TEAM sample solution (versions below ) to manage temporary elevated access through AWS IAM Identity Center, including forks or derivative code. Teams not running TEAM are not affected by this advisory.
1.5.1No product ranges from the sources yet.
1.5.1 are impacted.1.5.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Bulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT
Description:
Temporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.
Impacted versions: <1.5.1
Resolution:
This issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
None.
References:
Acknowledgement:
We would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-6x87-mjv8-mgvj")