CVE-2026-112407High· 8.8▾ TwilightIncorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and ac…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
CICD-toolchain-for-serverless-applications >= 1.0.7 <= 1.0.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86830High· 7.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or r…
CVE-2026-10591High· 8.8Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
CVE-2026-15957High· 7.5Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes
CVE-2026-5190High· 7.5AWS C Event Stream Streaming Decoder Stack Buffer Overflow
CVE-2026-6966Medium· 5.3Signature Threshold Bypass in awslabs/tough Delegated Roles
CVE-2026-6967Medium· 5.9Missing Delegated Metadata Validation in awslabs/tough