bartek@aws: ~/news
$ whoami
$ AWS Architect · DevOps · Cloud
Tuesday, October 20, 2026

AWS CICD-toolchain-for-serverless-applications: Privilege Escalation Vulnerability

AWS CICD-toolchain-for-serverless-applications versions 1.0.7–1.0.10 have a critical privilege escalation flaw (CVE-2026-112407). Authenticated users with repository push access can exploit incorrect IAM policies to access resources beyond their application stack. Update to version 1.0.11 or later immediately—this one requires your action.

source: [aws/security-bulletin]