☁️🚨 AWS DISCLOSES AMAZON CONNECT–SALESFORCE PRIVILEGE-ESCALATION FLAW — LAMBDA CAN BYPASS CALLER IAM RESTRICTIONS AWS has disclosed CVE-2026-94384, a newly published authorization vulnerability in the Amazon Connect Salesforce integration that can let a lower-privileged AWS identity use a setup Lambda as a confused deputy to perform AWS API operations its own IAM policy explicitly denies. • CVE-2026-94384 — CVSS 8.1 High • Affects Amazon Connect Salesforce Lambda versions 5.15 through 5.24.16 • The vulnerable sfExecuteAWSService Lambda accepts caller-supplied parameters and dispatches them to privileged AWS service APIs without validating whether the caller is authorized for the requested operation • Any IAM principal with lambda:InvokeFunction permission on that function can potentially cross its intended IAM permission boundary • Impact includes unauthorized access to or modification of AWS resources reachable through the Lambda’s execution role • The vulnerable function is intended only for initial setup and is disabled by default — exposure therefore depends on deployment configuration • AWS recommends upgrading to version 5.26+, then deleting or disabling sfExecuteAWSService; if it must remain enabled, invocation should be restricted to the intended IAM user only • No confirmed in-the-wild exploitation or public exploit has been identified at this time ⚠️ Analyst Note: The interesting cloud-security issue is the privilege-boundary bypass. An identity can be correctly denied an AWS API action by IAM, yet still reach that action indirectly if it is allowed to invoke a more privileged Lambda that fails to re-authorize the requested operation. Organizations using the Amazon Connect–Salesforce integration should check not only package version but whether this setup function was left enabled and who currently has permission to invoke it. Original AWS security bulletin: https://aws.amazon.com/security/security-bulletins/2026-115-aws/ Original GitHub security advisory: https://github.com/amazon-connect/amazon-connect-salesforce-cti/security/advisories/GHSA-c9j2-qjfv-mm4p #AWS #AmazonConnect #Salesforce #CVE202694384 #CloudSecurity #IAM #PrivilegeEscalation #ThreatIntel #DDW #DarkWeb
