Amazon: Incorrect privilege assignment in CICD-toolchain-for-serverless-applications (CVE-2026-112407)

The AWS CICD-toolchain-for-serverless-applications, specifically versions 1.0.7 through 1.0.10, is impacted by an incorrect privilege assignment vulnerability (CVE-2026-112407). This vulnerability resides within the IAM policies defined by the toolchain. Remote authenticated users who possess push access to the application source repository can exploit the CI/CD pipeline deployment process. By crafting malicious application templates, an attacker can cause the pipeline to deploy resources or execute operations that exceed the intended scope of the application stack, effectively escalating privileges to interact with or modify other resources within the same AWS account. This flaw poses a significant risk to environment isolation and least-privilege configurations. Defenders should prioritize updating to version 1.0.11 or later to secure the toolchain's IAM policy.