---
id: CVE-2026-112407
title: >-
  Incorrect privilege assignment in AWS
  CICD-toolchain-for-serverless-applications
summary: >-
  Incorrect privilege assignment in the IAM policy of AWS
  CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote
  authenticated users with push access to the application source repository to
  escalate privileges and ac…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-266
vendor: AWS
product: CICD-toolchain-for-serverless-applications
affected:
  - CICD-toolchain-for-serverless-applications >= 1.0.7 <= 1.0.10
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:34:40.192Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112407'
references:
  - url: >-
      https://github.com/aws-samples/aws-lambda-sample-applications/releases/tag/1.0.11
  - url: >-
      https://github.com/aws-samples/aws-lambda-sample-applications/security/advisories/GHSA-f76m-4xrx-pvq5
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-141-aws/'
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.263Z'
---

## Overview

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.



To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

## Affected

- `CICD-toolchain-for-serverless-applications >= 1.0.7 <= 1.0.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.