AWS Addresses High Severity Vulnerability in Lambda Service
AWS has patched a high severity vulnerability in its Lambda service, allowing unauthorized actions due to a missing authorization check.
In this article
AWS has addressed a significant vulnerability affecting its Lambda service, assigned a CVSS score of 8.1, indicating a high severity level. The flaw, logged as CVE-2026-94384, resides in a Lambda function called sfExecuteAWSService. This function is part of the AmazonConnectSalesforceLambda integration, which connects Amazon Connect contact centers to Salesforce Service Cloud Voice. AWS patched the bug in June 2026, but it was only publicly disclosed on September 22, 2026.
The vulnerability stems from a missing authorization check in the sfExecuteAWSService function. Specifically, it allowed any IAM (Identity and Access Management) principal with permission to invoke the function to perform actions that their own IAM policies would typically deny. This effectively granted attackers the ability to bypass permissions and execute AWS API calls that should have been restricted. The issue was described as a “confused deputy problem,” where a privileged function acts on behalf of an unauthorized user without verifying their permissions.
AWS’s security bulletin explained that the flaw was tied to how the Lambda function handled caller-supplied parameters, executing operations under its own privileged execution role. An attacker only needed permission to invoke the function, while the function itself managed to execute higher-privilege API requests.
The National Vulnerability Database (NVD) provides two different CVSS scores for this vulnerability: a CVSS v3.1 base score of 8.1 and a CVSS v4.0 score of 6.4. The discrepancy arises from the two frameworks’ treatment of impact metrics. CVSS 3.1 assesses the impact on the vulnerable component itself as high, while CVSS 4.0 differentiates between the function’s direct impact and the impact on subsequent systems, leading to a lower overall score.
The timeline of events surrounding the vulnerability is notable. AWS released the first fixed version of the affected Lambda function on June 29, 2026, prior to its public advisory. However, the broader security community did not recognize the issue until early October 2026, nearly three weeks after the advisory was published. This delay leads to a gap in visibility for security teams monitoring AWS’s Serverless Application Repository, which could leave critical vulnerabilities unaddressed for extended periods.
Organizations using Amazon Connect integrated with Salesforce Service Cloud Voice through specific versions of the AmazonConnectSalesforceLambda application—specifically versions 5.15 to 5.24.16—are at risk. This situation is particularly concerning for contact centers, which often accumulate IAM configuration debts over time, creating security vulnerabilities that may go unnoticed.
AWS’s handling of this incident highlights ongoing challenges in cloud security, particularly regarding IAM misconfiguration across various platforms, including AWS, Azure, and Google Cloud. As cloud services continue to evolve, the need for robust security measures and vigilant monitoring becomes increasingly important.
