amazon aws CVE-2026-112407 in Amazon and Aws Products
Published on October 20, 2026

Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications

product logo product logo
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-112407 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.


Products Associated with CVE-2026-112407

stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Aws Cicd Toolchain Serverless Applications. Just hit a watch button to start following.

Amazon Aws
Aws Cicd Toolchain Serverless Applications

Affected Versions

AWS CICD-toolchain-for-serverless-applications: