CVE-2026-94384
Received Received - Intake

Missing Authorization in Amazon Connect Salesforce Lambda

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: AMZN

Description
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-94384
EUVD
EUVD-2026-84568

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
amazon amazon_connect_salesforce_lambda 5.26
amazon amazon_connect_salesforce_lambda From 5.26 (inc)
amazon amazon_connect_salesforce_lambda From 5.15 (inc) to 5.25 (exc)
amazon amazon_connect_salesforce_lambda to 5.24.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in the Amazon Connect Salesforce Lambda function named sfExecuteAWSService. It allows any IAM principal with lambda:InvokeFunction permission to invoke AWS service operations using the function's elevated execution role without proper authorization checks. The function dispatches caller-supplied parameters to privileged AWS APIs, enabling privilege escalation beyond the caller's actual permissions.

Detection Guidance

Detecting this vulnerability involves checking for the presence of the sfExecuteAWSService Lambda function in your AWS environment. Use AWS CLI commands like 'aws lambda list-functions' to list all Lambda functions and look for 'sfExecuteAWSService'. Verify if the function has lambda:InvokeFunction permissions assigned to unintended IAM principals using 'aws lambda get-policy --function-name sfExecuteAWSService'.

Impact Analysis

An attacker with lambda:InvokeFunction permission could perform AWS API operations that their IAM identity is explicitly denied. This could lead to unauthorized access to sensitive data, modification of resources, or disruption of services. The impact depends on the permissions of the Lambda function's execution role.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for GDPR (data protection), HIPAA (health information), or other regulations. It undermines access control and audit mechanisms, potentially resulting in non-compliance penalties or data breaches.

Mitigation Strategies

Immediately upgrade to AmazonConnectSalesforceLambda version 5.26 or later. After upgrading, delete or disable the sfExecuteAWSService Lambda function. If retaining the function, restrict lambda:InvokeFunction permissions to only the CTI Adapter's IAM user and set the SalesforceExecuteAWSServiceUser parameter to that user.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart