Privilege Escalation in Amazon Connect Salesforce Lambda Function
CVSS 4.0
6.4medium
EPSS
—
Published
()
Modified
AI analysis
The vulnerability is a missing authorization check in the Amazon Connect for Salesforce Lambda function (sfExecuteAWSService). It allows any IAM principal with lambda:InvokeFunction permission on that specific function to escalate privileges and perform AWS API operations their own IAM identity is denied. An attacker can invoke the function with crafted parameters to call privileged service APIs without validation. This affects AWS customers using the affected version of the Amazon Connect for Salesforce integration. No public proof-of-concept exploits or known in-the-wild exploitation has been reported.
What to do: Upgrade to version 5.26 or later of the amazon-connect-salesforce-lambda. After upgrading, either delete or disable the sfExecuteAWSService function. If the function must be retained, restrict its invocation to the intended IAM user only.
Affected
amazon-connect-salesforce-lambda
before 5.26
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.
A high-severity flaw (CVE-2026-94384) in an AWS Lambda application could let attackers bypass IAM permissions and perform privileged cloud actions.
AWS disclosed a high-severity authorization flaw, CVE-2026-94384, in its AmazonConnectSalesforceLambda application. The vulnerability in the sfExecuteAWSService Lambda function allows an attacker with only lambda:InvokeFunction permission to execute privileged AWS service operations, bypassing their own IAM restrictions. This privilege escalation issue affects versions 5.15 through 5.24.16 and has been patched in version 5.26.