{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aamazoncicd-toolchain-for-serverless-applications1.0.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:amazon:cicd-toolchain-for-serverless-applications:1.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazon:cicd-toolchain-for-serverless-applications:1.0.8:*:*:*:*:*:*:*","cpe:2.3:a:amazon:cicd-toolchain-for-serverless-applications:1.0.9:*:*:*:*:*:*:*","cpe:2.3:a:amazon:cicd-toolchain-for-serverless-applications:1.0.10:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-112407"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CICD-toolchain-for-serverless-applications (1.0.7-1.0.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eThe AWS CICD-toolchain-for-serverless-applications, specifically versions 1.0.7 through 1.0.10, is impacted by an incorrect privilege assignment vulnerability (CVE-2026-112407). This vulnerability resides within the IAM policies defined by the toolchain. Remote authenticated users who possess push access to the application source repository can exploit the CI/CD pipeline deployment process. By crafting malicious application templates, an attacker can cause the pipeline to deploy resources or execute operations that exceed the intended scope of the application stack, effectively escalating privileges to interact with or modify other resources within the same AWS account. This flaw poses a significant risk to environment isolation and least-privilege configurations. Defenders should prioritize updating to version 1.0.11 or later to secure the toolchain's IAM policy.\u003c/p\u003e\n","date_modified":"2026-10-20T21:56:43Z","date_published":"2026-10-20T21:56:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aws-cicd-priv-esc/","summary":"An incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications (versions 1.0.7-1.0.10) allows authenticated users with repository push access to perform unauthorized privilege escalation and resource modification across an AWS account.","title":"Amazon: Incorrect privilege assignment in CICD-toolchain-for-serverless-applications (CVE-2026-112407)","url":"https://feed.craftedsignal.io/briefs/2026-10-aws-cicd-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:amazon:cicd-Toolchain-for-Serverless-Applications:1.0.7:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}