Free AWS Security Whitepaper
    Toc Consulting Logo
    AWS Security Digest·Week 39 of 2026·Sep 21-27, 2026·7 items

    An Amazon Connect Setup Lambda That Let Any Invoker Exceed Their IAM Permissions

    A setup-only Lambda function in the Amazon Connect Salesforce integration let any principal allowed to invoke it perform AWS operations their own IAM permissions would deny. Also patched: a Kiro IDE flaw that could let a crafted repository, opened as an untrusted workspace, cause the agent to modify its auto-loaded global configuration, a code-execution bug in the pgcollection PostgreSQL extension, and a single-packet shutdown in s2n-quic. On the launch side, AWS Network Security Manager reached general availability.

    In this issue4high3info

    Highlights

    1 item
    $ tail -f /var/log/aws-security.log
    high/CVE/

    CVE-2026-94384: Missing Authorization in the Amazon Connect Salesforce Lambda Setup Function

    CVE-2026-94384Bulletin 2026-115-AWS

    The sfExecuteAWSService Lambda function in AmazonConnectSalesforceLambda, a Serverless Application Repository application for integrating Amazon Connect with Salesforce, passed caller-supplied parameters to privileged AWS service APIs without checking whether the caller was authorized. Any IAM principal with lambda:InvokeFunction on the function could therefore perform AWS operations that its own IAM permissions would otherwise deny. AWS notes the function is used only during initial setup.

    Remediation: upgrade to version 5.26 or later, then delete or disable sfExecuteAWSService once setup is complete. If you keep it, grant lambda:InvokeFunction only to the single IAM user the CTI Adapter uses, and set the SalesforceExecuteAWSServiceUser parameter to that same user to limit cross-account invocation. Credited to Chang Li of Xidian University via coordinated disclosure.

    Affected
    • AmazonConnectSalesforceLambda 5.15-5.24.16
    Fixed In
    • AmazonConnectSalesforceLambda 5.26
    Amazon ConnectLambdaIAM

    CVEs & Vulnerabilities

    3 items
    $ cat /var/reports/CVE_REPORT.txt
    high/CVE/

    CVE-2026-95985: Kiro IDE File Write Tool Could Modify Global Agent Configuration

    CVE-2026-95985Bulletin 2026-117-AWS

    The file write tool in Kiro IDE before 1.0.242 might allow remote unauthenticated actors to execute arbitrary commands and inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository opened as an untrusted workspace, sending any message can cause the agent to modify auto-loaded global configuration paths.

    Fixed in Kiro IDE 1.0.242; no workaround. AWS advises anyone who ran the agent in an untrusted workspace on an earlier version to review the global Kiro configuration directory (~/.kiro on macOS and Linux, %USERPROFILE%\.kiro on Windows) for entries they did not create. Credited to Dinh Ngoc Dung via coordinated disclosure.

    Affected
    • Kiro IDE < 1.0.242
    Fixed In
    • Kiro IDE 1.0.242
    Kiro
    high/CVE/

    CVE-2026-96883: Type Confusion in the pgcollection PostgreSQL Extension

    CVE-2026-96883Bulletin 2026-118-AWS

    A flaw in the type coercion logic of pgcollection, an open-source PostgreSQL extension, causes it to misinterpret a stored icollection value when that value is requested as a type incompatible with how it was stored. An authenticated database user can use this to crash the PostgreSQL backend or execute arbitrary code.

    Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not affected: AWS states both ship only pgcollection 1.1.1, which does not contain the issue. Customers who built pgcollection 2.0.0 through 2.1.1 from the AWS GitHub repository into their own PostgreSQL deployments should upgrade to 2.1.2 or later.

    Affected
    • pgcollection 2.0.0-2.1.1 (self-compiled)
    Fixed In
    • pgcollection 2.1.2
    PostgreSQL
    high/CVE/

    CVE-2026-94450: Single Crafted UDP Datagram Can Shut Down an s2n-quic Server

    CVE-2026-94450Bulletin 2026-116-AWS

    s2n-quic, a Rust implementation of the QUIC protocol, did not properly validate the Destination Connection ID length when a server is configured to send Retry packets. In s2n-quic 1.88.0 and earlier, an unauthenticated user can shut down such a server endpoint with a single crafted UDP datagram. Only servers configured to issue Retry packets are affected, and AWS states no AWS services are affected.

    Fixed in s2n-quic 1.89.0; there is no workaround other than upgrading.

    Affected
    • s2n-quic <= 1.88.0
    Fixed In
    • s2n-quic 1.89.0
    s2n

    Service Updates

    3 items
    $ aws securityhub get-findings --query 'ServiceUpdates'
    info/Feature Launch/

    AWS Network Security Manager Is Generally Available in US East (N. Virginia)

    AWS Network Security Manager is a network security management solution for deploying and enforcing network security policy across an AWS organization. At launch it supports AWS WAF and AWS Shield Advanced, automatically applying protections to internet-facing resources such as Application Load Balancers and CloudFront distributions, detecting configuration drift, and remediating it. AWS says AWS Network Firewall support will follow.

    General availability is limited to the US East (N. Virginia) Region for now.

    Network Security ManagerAWS WAFShield Advanced
    info/Feature Launch/

    IAM Outbound Identity Federation OIDC Discovery Now Reachable Through VPC Endpoints

    With IAM outbound identity federation, AWS workloads request short-lived JWTs from AWS STS instead of holding long-lived credentials for external services, and those services verify the tokens against public OIDC discovery and JWKS endpoints. Until now those endpoints were reachable only over the public internet, so a verifying workload in a VPC without internet access could not fetch them. They can now be reached through an interface VPC endpoint over AWS PrivateLink.

    Available in all commercial Regions, the AWS GovCloud (US) Regions and the China Regions, at standard PrivateLink pricing.

    IAMSTSPrivateLink
    info/Feature Launch/

    Security Hub AI Inventory Now Discovers AI Assets on Azure VMs

    AWS Security Hub AI Inventory can now discover and catalog AI assets running on self-hosted Microsoft Azure virtual machines, using Amazon Inspector SBOM analysis to identify inference endpoints, models and AI agents, including frameworks such as Ollama, vLLM and Hugging Face TGI. Discovered assets are mapped to their infrastructure and correlated with security findings across AWS and Azure.

    Included with Security Hub Essentials at no additional cost.

    Security HubInspector

    Key Takeaway

    1 item
    $ cat WEEKLY_SUMMARY.md

    The Connect Salesforce bug is a confused-deputy pattern worth hunting for in your own accounts: any Lambda function whose execution role is broader than the people allowed to invoke it hands that extra privilege to every one of them. Audit who holds lambda:InvokeFunction on privileged functions, and delete setup-only functions once setup is done.

    Filed Under
    Amazon ConnectLambdaIAMKiroPostgreSQLs2n-quicNetwork Security ManagerSecurity Hub
    Previous
    Week 38 - Sep 14 - Sep 20, 2026
    Next
    Week 40 - Sep 28 - Oct 4, 2026

    Need Custom Security Briefings?

    These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.

    All DigestsSubscribe via RSSGet in Touch