CVE-2026-112407 Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112407?
CVE-2026-112407 is a high-severity vulnerability in AWS CICD-toolchain-for-serverless-applications, published on 20 Oct 2026.
Official description
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
Weakness: CWE-266
Which versions are affected by CVE-2026-112407?
How do I fix CVE-2026-112407?
No fix has been published for CVE-2026-112407 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112407 being exploited?
There is no known exploitation of CVE-2026-112407 in the wild and no public exploit code.
Sources
Also known as GHSA-f76m-4xrx-pvq5.