Talk to an expert
ProductsSolutionsTrustPricingNewsTalk to an expert
Back to Newsroom
Threat Intel

AWS Lambda Flaw Let Low-Privilege Users Escalate to Broader Cloud Access

A Lambda function used to set up the Amazon Connect–Salesforce integration forwarded caller-controlled input to AWS APIs under its own privileged role — letting minimally-permissioned identities bypass their own IAM restrictions. AWS has shipped a fix.

4T4Tify Team4Tify
Sep 23, 2026·4 min read
AWS Lambda Flaw Let Low-Privilege Users Escalate to Broader Cloud Access

What happened

AWS has patched a high-severity authorization flaw, tracked as CVE-2026-94384, in the AmazonConnectSalesforceLambda package — specifically in the sfExecuteAWSService function that helps configure the Amazon Connect CTI Adapter for Salesforce.

The function is meant to run one-time AWS setup steps during deployment. The problem: it forwarded caller-supplied parameters straight through to AWS service APIs while executing under its own privileged IAM role, without properly limiting which operations the calling principal was actually authorized to request.

In practice, that meant any identity holding nothing more than lambda:InvokeFunction permission on this one function could ride its execution role to perform AWS actions that identity's own policy would otherwise block — turning a setup utility into an unintended privilege-escalation proxy.

Why it matters

The blast radius scales with whatever the Lambda's execution role is allowed to do — anywhere from reading data to modifying cloud resources across the account. Risk is highest where invoke access to the function was left broad: shared with developers, automation accounts, or third-party integrations, rather than restricted to the single CTI Adapter identity that actually needs it.

Because the function is only meant to run during initial setup, many organizations likely still have it sitting active — and reachable — long after the integration was configured, which is exactly the scenario AWS flags as risky.

AWS credited Chang Li of Xidian University with reporting the issue through coordinated disclosure.

What to do

  • Upgrade immediately to AmazonConnectSalesforceLambda version 5.26 or later, which contains the fix for CVE-2026-94384.
  • Remove the function once setup is done. AWS recommends deleting or disabling sfExecuteAWSService after the Amazon Connect–Salesforce integration is configured — it has no ongoing purpose.
  • If you must keep it, restrict lambda:InvokeFunction to the single IAM user used by the CTI Adapter, and use a Service Control Policy or permission boundary to explicitly deny invocation for every other principal.
  • Align identities: set SalesforceExecuteAWSServiceUser to the same IAM user authorized for the CTI Adapter so the two configurations can't drift apart.
  • Audit for abuse: review IAM policies, Lambda resource policies, execution-role permissions, CloudTrail logs, and cross-account trust relationships for any invocation of this function you can't account for.
SHARE