Critical AWS Lambda Flaw Bypasses IAM, Exposes Cloud Services

Key Takeaways

• A high-severity authorization bypass vulnerability (CVE-2026-94384) was discovered in the AWS Lambda function used with the Amazon Connect Salesforce integration.
• The flaw allows attackers to perform privileged AWS cloud actions beyond their assigned IAM permissions.
• Affected versions include AmazonConnectSalesforceLambda 5.15 through 5.24.16.
• AWS has released version 5.26 to patch the vulnerability and provides critical mitigation advice.

Critical AWS Lambda Flaw Bypasses IAM, Exposes Cloud Services

AWS has disclosed a significant authorization vulnerability within its Amazon Connect Salesforce Lambda application. This high-severity flaw, identified as CVE-2026-94384, could enable malicious actors to execute privileged operations in the cloud environment, bypassing the intended restrictions of their assigned IAM (Identity and Access Management) permissions.

Vulnerability Details

The vulnerability specifically impacts the sfExecuteAWSService Lambda function, which is embedded within AmazonConnectSalesforceLambda versions 5.15 through 5.24.16. The AmazonConnectSalesforceLambda application itself is a Serverless Application Repository offering designed to facilitate the integration of Amazon Connect contact center services with Salesforce.

The sfExecuteAWSService function plays a crucial role during the initial setup phase of this integration, assisting in the execution of necessary AWS service operations for configuration. The core of the flaw lies in the function’s inadequate authorization verification. It fails to properly confirm whether the calling entity is genuinely authorized to request the AWS operation specified in its parameters.

How the Bypass Works

Instead of validating the caller’s permissions, the function proceeds to dispatch caller-controlled parameters to AWS service APIs, leveraging its own highly privileged execution role. This mechanism creates a dangerous permission-bypass scenario. An IAM principal, requiring only lambda:InvokeFunction permission for the vulnerable function, could potentially trigger AWS operations that their individual IAM policy would otherwise prohibit.

Essentially, the Lambda function transforms into a privileged proxy, usable by lower-privileged users or compromised identities. An attacker who gains access to an IAM identity with the ability to invoke this function could exploit it to access various AWS services, modify cloud resources, or perform any actions permitted by the Lambda function’s elevated execution role. The potential impact of such an exploit is directly proportional to the permissions granted to the function’s role and the scope of AWS APIs accessible via the supplied parameters.

AWS emphasized that the affected function is intended solely for initial deployment and configuration. Organizations that neglect to disable or remove it after setup inadvertently create an unnecessary avenue for privilege escalation. This issue is particularly concerning in environments where Lambda invocation permissions are broadly distributed among developers, automation accounts, third-party integrations, or other IAM principals.

What You Should Do

• Upgrade Immediately: AWS has released AmazonConnectSalesforceLambda version 5.26 to fix CVE-2026-94384. Organizations utilizing any impacted versions (5.15 through 5.24.16) must upgrade without delay.
• Review Function Necessity: After configuring your Amazon Connect and Salesforce integration, evaluate whether the sfExecuteAWSService function is still required.
• Delete or Disable: Post-setup, AWS recommends deleting or turning off the sfExecuteAWSService Lambda function.
• Strictly Limit Access: If the function absolutely must be retained, rigorously restrict lambda:InvokeFunction access to only the single IAM user specifically designated for the CTI Adapter. No other IAM users, roles, groups, or principals should be allowed to invoke it.
• Implement Stronger Controls: For enhanced protection, employ AWS Service Control Policies (SCPs) or permission boundaries to explicitly deny invocation access for all other principals.
• Configure SalesforceExecuteAWSServiceUser Parameter: Ensure the SalesforceExecuteAWSServiceUser parameter is configured with the same IAM user authorized to use the CTI Adapter to help restrict cross-account invocation.
• Verify Removal/Disabling: Security teams should actively verify that the vulnerable function has been removed or disabled post-setup.
• Audit for Anomalies: To safeguard data, regularly check IAM policies, Lambda resource policies, execution roles, CloudTrail logs, and cross-account trust settings for any unexpected or suspicious usage patterns.

AWS has credited Chang Li of Xidian University for responsibly reporting this vulnerability through the coordinated disclosure process.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.