AWS Lambda Flaw Lets Attackers Bypass IAM Permissions and Access Cloud Services

AWS disclosed a high-severity authorization flaw in its Amazon Connect Salesforce Lambda application that could let attackers perform privileged cloud actions beyond their assigned IAM permissions.

The vulnerability, tracked as CVE-2026-94384, affects the sfExecuteAWSService Lambda function included with AmazonConnectSalesforceLambda versions 5.15 through 5.24.16.

AmazonConnectSalesforceLambda is a Serverless Application Repository application designed to integrate Amazon Connect contact-center services with Salesforce.

The affected Lambda function is used during the initial setup process, where it helps the integration perform AWS service operations required for configuration.

The flaw exists because the sfExecuteAWSService function does not properly verify whether the caller is authorized to request the AWS operation supplied in its parameters.

AWS Lambda Flaw

Instead, the function can dispatch caller-controlled parameters to AWS service APIs while using its own privileged execution role. This creates a permission-bypass condition.

An IAM principal only needs lambda: InvokeFunction permission for the vulnerable function to potentially execute AWS operations that their individual IAM policy would normally block.

In effect, the Lambda function can become a privileged proxy for lower-privileged users or compromised identities. An attacker who obtains access to an IAM identity with permission to invoke the function could abuse the issue to access AWS services, modify cloud resources, or carry out actions allowed by the Lambda execution role.

The possible impact depends on the permissions assigned to the function’s role and the AWS APIs available through the supplied parameters.

AWS said the affected function is intended only for initial deployment and setup. Organizations that leave it enabled after configuration may unnecessarily expose a route for privilege escalation.

The issue is especially significant in environments where Lambda invocation permissions are broadly granted to developers, automation accounts, third-party integrations, or other IAM principals.

AWS has released AmazonConnectSalesforceLambda version 5.26 to address CVE-2026-94384. Organizations using impacted versions should upgrade immediately and review whether the sfExecuteAWSService function remains necessary after the Amazon Connect and Salesforce integration has been configured.

After completing setup, AWS recommends deleting or turning off the sfExecuteAWSService Lambda function. If an organization must retain the function, it should strictly limit lambda: InvokeFunction access to the single IAM user used by the CTI Adapter. No other IAM users, roles, groups, or principals should be permitted to invoke it.

For stronger protection, organizations can use AWS Service Control Policies or permission boundaries to deny invocation access for all other principals explicitly.

Administrators should also configure the SalesforceExecuteAWSServiceUser parameter with the same IAM user authorized to use the CTI Adapter, helping restrict cross-account invocation. Security teams should verify that the vulnerable function has been removed or disabled after setup.

If you need to keep data safe, teams should check IAM policies, Lambda resource policies, execution roles, CloudTrail logs, and cross-account trust settings for any unexpected usage.AWS credited Chang Li of Xidian University for reporting the issue through the coordinated vulnerability disclosure process.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC