Live › vulnerability › GHSA-c9j2-qjfv-mm4p
Go to dashboardThe AmazonConnectSalesforceLambda Serverless Application Repository app has a sfExecuteAWSService Lambda function that forwards caller-supplied parameters to privileged AWS APIs without checking authorization. Any IAM principal with lambda:InvokeFunction on that function can perform AWS operations their own IAM permissions would normally deny.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC. All times on this page are UTC.
Teams that deployed the AmazonConnectSalesforceLambda app from the Serverless Application Repository to connect Amazon Connect with Salesforce, in versions 5.15 through 5.24.16. Exposure depends on which principals can invoke the sfExecuteAWSService function, so accounts where only the CTI Adapter user can invoke it have less risk. Teams that never deployed this app can skip it.
No product ranges from the sources yet.
5.15 and 5.24.16sfExecuteAWSService still exists in the accountlambda:InvokeFunction on that function and whether SalesforceExecuteAWSServiceUser names a single IAM user5.26 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-94384 - Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService
Bulletin ID: 2026-115-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 10:00 AM PDT
Description:
Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) is a Serverless Application Repository application that provides Lambda functions for integrating Amazon Connect with Salesforce. We identified CVE-2026-94384, a missing authorization issue in the sfExecuteAWSService Lambda function, which is used only during initial setup. The function dispatches caller-supplied parameters to privileged AWS service APIs without validating the caller's authorization. As a result, an IAM principal with lambda:InvokeFunction permission on the function can perform AWS operations that their own IAM permissions would otherwise deny.
Impacted versions: >= 5.15 AND <= 5.24.16
Resolution:
To remediate this issue, upgrade to AmazonConnectSalesforceLambda version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you keep the function, restrict who can invoke it: within your account, grant lambda:InvokeFunction on the function only to the single IAM user the CTI Adapter uses to call it and to no other principal (for stronger enforcement, deny it for all other principals using a service control policy or permission boundary); and set the SalesforceExecuteAWSServiceUser parameter to that same IAM user so that cross-account invocation is limited to it.
Verification:
Confirm the sfExecuteAWSService function has been deleted or disabled after setup. If you keep the function, confirm that within your account lambda:InvokeFunction on the function is granted only to the CTI Adapter's IAM user, and that the SalesforceExecuteAWSServiceUser parameter names that same user.
References:
Acknowledgement:
We would like to thank Chang Li of Xidian University for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-c9j2-qjfv-mm4p")