CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew
CVE-2026-112380
Summary
Bulletin ID: 2026-141-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/20/2026 13:30 PM PDT
Description:
CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository.
We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications before 1.0.11 that allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
Impacted versions: =1.0.7 AND <=1.0.10
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.