CVE-2026-112407: CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10

Affected technology

CICD-toolchain-for-serverless-applications · 1.0.7 through 1.0.10
AWS

Description’s affected range: through 1.0.10

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Remote authenticated users with push access to the application source repository can escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.