Key points
- CVE-2026-112407 affects AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10.
- The flaw allows remote authenticated users with repository push access to escalate privileges.
- AWS released version 1.0.11 to address the incorrect privilege assignment in IAM policies.
AWS released version 1.0.11 of the CICD-toolchain-for-serverless-applications sample application to fix a high-severity security flaw. This update addresses CVE-2026-112407, which affects versions 1.0.7 through 1.0.10. The vulnerability exists in the Identity and Access Management policy configuration. According to the National Vulnerability Database, the issue carries a CVSS score of 8.8.
In plain English
The flaw allows attackers to gain more control than they should have. If a user has permission to push code to the application source repository, they can exploit this weakness. They can then access or modify resources that exist outside the specific application stack. This happens because the toolchain pipeline deploys application templates with incorrect privilege assignments. The attack requires the user to be authenticated and have push access.
The background
AWS describes the CICD-toolchain-for-serverless-applications as a sample application. It provisions a continuous integration and continuous delivery pipeline for serverless applications. The pipeline operates through the AWS Serverless Application Repository. AWS Security Bulletins published bulletin 2026-141-AWS on October 20, 2026. The bulletin classifies the content as important and requiring attention. Changli from Xidian University collaborated on the disclosure.
What changes now
Users must upgrade existing toolchain stacks to version 1.0.11 or later. AWS explicitly recommends ensuring any forked or derivative code is patched. This ensures the new fixes are incorporated into custom implementations. The vendor has addressed the issue in the latest release. No further action is required once the upgrade is complete and verified.
Who needs to act first
Teams should prioritize updating systems that expose the source repository to external contributors. Check whether any development environments use the affected versions. Roll out the fix in a staging environment first to verify pipeline stability. Back up current configurations before applying the upgrade. Monitor access logs for unusual privilege changes during the transition. Ensure all derivative codebases receive the same patch treatment to maintain consistent security posture across the organization.
What to do and how to stay safe: AWS
- Verify the current version of the CICD-toolchain-for-serverless-applications in your AWS account.
- Upgrade to version 1.0.11 or later as soon as possible.
- Audit IAM policies for any custom forks or derivative codebases.
- Monitor repository access logs for unauthorized push attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions are affected by CVE-2026-112407?
Versions 1.0.7 through 1.0.10 of AWS CICD-toolchain-for-serverless-applications are affected.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-112407 as 8.8, which is high severity.
Is there a fix available?
Yes, AWS released version 1.0.11 to address the incorrect privilege assignment issue.
