CVE-2026-112407

Summary

The IAM policy in AWS CICD-toolchain-for-serverless-applications versions 1.0.7–1.0.10 incorrectly assigns excessive privileges to the pipeline role, allowing authenticated users with push access to deploy templates that grant themselves broader permissions than intended, enabling full compromise of other resources in the same AWS account.

Exploitability

Exploitation requires authenticated push access to the application source repository and ability to modify or deploy malicious application templates; low barrier for insiders or compromised developer accounts.

Blast radius

Successful exploitation allows attackers to read, modify, or delete any AWS resource accessible to the compromised pipeline role—including S3 buckets, Lambda functions, DynamoDB tables, and other infrastructure—within the same AWS account.

Detection

Monitor CloudTrail for IAM policy updates (e.g., PutRolePolicy, AttachRolePolicy) triggered by the pipeline’s assumed role during CodePipeline execution, especially if those changes grant permissions outside the expected application stack scope; also watch for unusual resource creation/modification events in CloudTrail or Config that correlate with pipeline runs.

Prioritized remediation

Upgrade existing toolchain stacks to version 1.0.11 or later, as explicitly recommended by the vendor.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.