CVE-2026-112407

HighCVSS 8.8/10Last modified Oct 28, 2026

Description

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.

To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AWSCICD-toolchain-for-serverless-applications>= 1.0.7, <= 1.0.10

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 28, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1124088.1Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 aCVE-2026-112418.0Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment CVE-2026-1124107.5A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOCVE-2026-1124136.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS CVE-2026-1124146.5A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2CVE-2026-1124156.5An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOCVE-2026-1124165.5An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and CVE-2026-1124177.8An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D CVE-2026-112427.5Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised CVE-2026-1124214.7A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2CVE-2026-1124236.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS CVE-2026-1124247.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macO
CVE-2026-112407: High severity, CVSS 8.8 | Vulnix