CVE-2026-94384

Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

State: Published
Severity: 6.4 Medium
Published: Sep 22, 2026
Updated: Sep 22, 2026
Reserved: Sep 21, 2026

Description

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation.

To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.

Scores

CVSS	Score	Vector	Source
4.0	6.4 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N	AMZN
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	AMZN

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
amazon-connect-salesforce-lambdaAmazon	5.15 through 5.24.16Affected

References

https://github.com/amazon-connect/amazon-connect-salesforce-lambda/releases/tag/v5.26patchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-115-aws/vendor-advisory
https://github.com/amazon-connect/amazon-connect-salesforce-cti/security/advisories/GHSA-c9j2-qjfv-mm4prelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.