AWS Lambda Flaw Lets Users Bypass Security Limits
A high-severity bug in an AWS integration app allows users to exceed their intended permissions.
Key points
- AWS fixed a flaw in AmazonConnectSalesforceLambda versions 5.15 to 5.24.16 that allowed privilege escalation.
- The vulnerable function used its own high-level role to execute commands, bypassing user-specific security limits.
- Users should upgrade to version 5.26 and delete the setup function after configuration to prevent abuse.
Amazon Web Services has fixed a serious security gap in a tool that links its contact center software to Salesforce. The flaw, identified as CVE-2026-94384, affected specific versions of the AmazonConnectSalesforceLambda application. CyberSecurityNews reported that this issue allowed attackers to perform actions they were not supposed to be able to do.
The problem lay in a specific function used only for initial setup. This function did not properly check if the user was allowed to request certain cloud operations. Instead, it used its own high-level access rights to run those commands. This created a path for privilege escalation that could expose sensitive cloud resources.
How the security gap works
In normal operations, users have specific limits on what they can access. However, this vulnerable function acted like a proxy. It could dispatch commands to AWS services using its own privileged role. This meant a user with basic access could potentially modify critical cloud resources.
The risk was highest in environments where many developers or automation accounts had permission to use the function. If an attacker compromised one of these accounts, they could abuse the flaw. The extent of the damage depended on the permissions assigned to the function's role.
Steps to secure your cloud account
AWS has released version 5.26 of the application to fix this issue. Organizations using versions 5.15 through 5.24.16 should upgrade immediately. After completing the initial setup, the company recommends deleting or disabling the vulnerable function entirely.
If you must keep the function active, you must strictly limit who can use it. Only the specific user account required for the integration should have access. Security teams should also review their logs to check for any unexpected usage of this tool.
Long-term protection for cloud users
For stronger security, administrators can use broader policy controls to deny access to all other users. This ensures that even if a specific permission is granted, the overall system blocks unauthorized actions. It is a critical step for keeping cloud environments safe from internal threats.
