AWS Lambda Flaw Lets Attackers Bypass IAM Permissions and Access Cloud Services
A high-severity flaw (CVE-2026-94384) in an AWS Lambda application could let attackers bypass IAM permissions and perform privileged cloud actions.
AWS disclosed a high-severity authorization flaw, CVE-2026-94384, in its AmazonConnectSalesforceLambda application. The vulnerability in the sfExecuteAWSService Lambda function allows an attacker with only lambda:InvokeFunction permission to execute privileged AWS service operations, bypassing their own IAM restrictions. This privilege escalation issue affects versions 5.15 through 5.24.16 and has been patched in version 5.26.
- A high-severity flaw in AWS Lambda could let attackers bypass IAM permissions.
- CVE-2026-94384 affects the AmazonConnectSalesforceLambda application versions 5.15 to 5.24.16.
- The vulnerability allows a low-privileged user to execute operations using the Lambda's own privileged role.
- AWS recommends upgrading to version 5.26 and disabling the function after setup.
- CVEs
- CVE-2026-94384
- Vendors
- Amazon Web Services
- Products
- AmazonConnectSalesforceLambda
- Organizations
- AWSXidian University
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94384 | Privilege Escalation in Amazon Connect Salesforce Lambda Function | 6.4 | — |
From the original article
2 min read at cybersecuritynews.com
AWS disclosed a high-severity authorization flaw in its Amazon Connect Salesforce Lambda application that could let attackers perform privileged cloud actions beyond their assigned IAM permissions. The vulnerability, tracked as CVE-2026-94384, affects the sfExecuteAWSService Lambda function included with AmazonConnectSalesforceLambda versions 5. 15 through 5.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.