Missing Authorization in AmazonConnectSalesforceLambda sfExecuteAWSService
UnratedCVE-2026-94384 · Published Sep 22, 2026
Bulletin ID: 2026-115-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 10:00 AM PDT Description: Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) is a Serverless Application Repository application that provides Lambda functions for integrating Amazon Connect with Salesforce. We identified CVE-2026-94384, a missing authorization issue in the sfExecuteAWSService Lambda function, which is used only during initial setup. The function dispatches caller-supplied parameters to privileged AWS service APIs without validating the caller's authorization. As a result, an IAM principal with lambda:InvokeFunction permission on the function can perform AWS operations that their own IAM permissions would otherwise deny. Impacted versions: >= 5.15 AND <= 5.24.16 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
Details and references
- Severity from
- no source yet
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 22 | Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths High8.8Sep 22 | High8.8 | No fix yet |
| Sep 22 | Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible...High8.0Sep 22 | High8.0 | No fix yet |
| Sep 22 | HTTPS Fallback to HTTP in Graph ExplorerMedium5.9Sep 22 | Medium5.9 | No fix yet |
| Sep 22 | Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent ImportCritical9.0Sep 22 | Critical9.0 | No fix yet |
| Sep 22 | Issue with HTTP/2 multi-frame request body inspection in AWS WAFCritical9.8Sep 22 | Critical9.8 | No fix yet |
| Sep 22 | Authenticated SQL injection in the metrics-service retention policy subsystem of...High8.1Sep 22 | High8.1 | No fix yet |