{"id":"GHSA-6x87-mjv8-mgvj","kind":"vulnerability","aliases":["GHSA-6x87-mjv8-mgvj"],"related":[],"title":"CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center","description":"CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\n### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\nBulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT\n\nDescription:\n\nTemporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.\n\nImpacted versions: <1.5.1\n\nResolution:\n\nThis issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-86830\n- GHSA-6x87-mjv8-mgvj\n\nAcknowledgement:\n\nWe would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"TEAM is an open source AWS sample solution for managing temporary elevated access through IAM Identity Center. An authenticated user with application-level access can gain temporary elevated access to AWS accounts managed by TEAM that they should not have.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-accounts","iam-identity-center","infrastructure","lab-disclosure","self-hosted"],"not_affected_if":["not-using-team"],"how_to_check":"- Check the deployed TEAM version; the sources say versions below `1.5.1` are impacted.\n- Check whether any forked or derivative TEAM code is in use and whether it includes the fix.","fix":"- Upgrade TEAM to `1.5.1` or later.\n- Patch any forked or derivative code to incorporate the fix.","status":"open","published_at":"2026-09-14T00:00:00+00:00","first_seen_at":"2026-10-24T19:12:58+00:00","triaged_at":"2026-10-25T05:30:29+00:00","updated_at":"2026-10-25T05:30:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:30:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TEAM to `1.5.1` or later.\n- Patch any forked or derivative code to incorporate the fix.","reach":"network","title":"AWS TEAM: authenticated users gain unintended temporary elevated access to accounts","impact":"high","summary":"TEAM is an open source AWS sample solution for managing temporary elevated access through IAM Identity Center. An authenticated user with application-level access can gain temporary elevated access to AWS accounts managed by TEAM that they should not have.","category":"infrastructure","nicknames":[],"who_cares":["aws","iam-identity-center","aws-accounts","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user gains unintended elevated access to AWS accounts","analyst_note":"","how_to_check":"- Check the deployed TEAM version; the sources say versions below `1.5.1` are impacted.\n- Check whether any forked or derivative TEAM code is in use and whether it includes the fix.","needs_analyst":false,"not_affected_if":["not-using-team"],"who_is_affected":"Teams running the TEAM sample solution (versions below `1.5.1`) to manage temporary elevated access through AWS IAM Identity Center, including forks or derivative code. Teams not running TEAM are not affected by this advisory.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3806,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112':116C '-2026':2A,80C,97C,158C,219C '-86830':3A,81C,98C,159C,220C '09/14/2026':127C '1.5.1':183C,193C '10':128C '2026':115C '45':129C '6x87':20A,25A,223C 'access':10A,55B,67B,72B,88C,105C,135C,149C,168C,174C 'account':31B,75B,177C 'acknowledg':226C 'address':189C 'ai':236C 'applic':65B,166C 'application-level':64B,165C 'assign':6A,84C,101C 'attent':124C 'authent':61B,162C 'aw':14A,28B,30B,48B,74B,92C,109C,117C,119C,142C,151C,176C 'aws-account':29B 'aws-security@amazon.com':250C 'bulletin':113C 'center':17A,35B,59B,95C,112C,154C 'code':207C 'collabor':238C 'concern':256C 'content':120C 'coordin':244C 'could':169C 'cujo':235C 'cve':1A,79C,96C,157C,218C 'date':126C 'deriv':206C 'descript':132C 'disclosur':39B,246C 'elev':9A,54B,71B,87C,104C,134C,148C,173C 'email':249C 'ensur':202C 'fix':214C 'fork':204C 'gain':69B,170C 'ghsa':19A,24A,222C 'ghsa-6x87-mjv8-mgvj':18A,23A,221C 'host':42B 'iam':15A,33B,57B,93C,110C,152C 'iam-identity-cent':32B 'id':114C 'ident':16A,34B,58B,94C,111C,153C 'identifi':156C 'impact':181C 'import':122C 'incorpor':211C 'incorrect':4A,82C,99C 'infrastructur':36B 'issu':186C,241C 'jani':232C 'lab':38B 'lab-disclosur':37B 'latest':199C 'level':66B,167C 'like':229C 'manag':11A,52B,76B,89C,106C,136C,146C,178C 'mgvj':22A,27A,225C 'mjv8':21A,26A,224C 'muuriaisniemi':233C 'new':213C 'none':216C 'open':46B,140C 'patch':209C 'pdt':131C 'pleas':248C 'privileg':5A,83C,100C 'process':247C 'public':125C 'question':254C 'recommend':195C 'refer':217C 'requir':123C 'resolut':184C 'sampl':49B,143C 'scope':118C 'secur':253C 'self':41B 'self-host':40B 'solut':50B,144C 'sourc':47B,141C 'team':12A,43B,78B,90C,107C,137C,180C,191C 'temporari':8A,53B,70B,86C,103C,133C,147C,172C 'thank':231C 'type':121C 'unintend':171C 'upgrad':196C 'user':62B,163C 'version':182C,192C,200C 'via':150C 'vulner':245C 'workaround':215C 'would':228C","nicknames":[],"mitigations":[],"who_affected":"Teams running the TEAM sample solution (versions below `1.5.1`) to manage temporary elevated access through AWS IAM Identity Center, including forks or derivative code. Teams not running TEAM are not affected by this advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-14T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/#GHSA-6x87-mjv8-mgvj","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/","severity":null,"published_at":"2026-09-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T19:12:58+00:00","note":"AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center"}],"documents":[{"id":2931,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/","title":"AWS: CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center","kind":"advisory","source":"lab","text":"CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\n### CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center\n\nBulletin ID: 2026-112-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/14/2026 10:45 AM PDT\n\nDescription:\n\nTemporary Elevated Access Management (TEAM) is an open source AWS sample solution for managing temporary elevated access via AWS IAM Identity Center. We identified CVE-2026-86830, where an authenticated user with application-level access could gain unintended temporary elevated access to AWS accounts managed by TEAM.\n\nImpacted versions: <1.5.1\n\nResolution:\n\nThis issue has been addressed in TEAM version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-86830\n- GHSA-6x87-mjv8-mgvj\n\nAcknowledgement:\n\nWe would like to thank Jani Muuriaisniemi at CUJO AI for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-14T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}