Improper Access Control in NXP's nxp-auto-goldvip Lambda Function
CVE-2026-19359

5.1MEDIUM

Key Information:

Vendor

Nxp-auto-goldvip

Status
Gvip
Vendor
CVE Published:
9 August 2026

What is CVE-2026-19359?

A security issue has been identified in NXP's nxp-auto-goldvip, specifically in the SitewiseCustomFunction of the Lambda Function Handler. This vulnerability allows for improper access control, leading to potential exploitation through remote attacks. Users are strongly recommended to upgrade to version 1.15.0, which rectifies the IAM permission configuration concerns that had been acknowledged and addressed in earlier updates, commencing with version 1.13.0. It is critical for users relying on the legacy versions to act swiftly to enhance the security posture of their systems.

Affected Version(s)

gvip 1.0

gvip 1.1

gvip 1.2

References

https://vuldb.com/vuln/387213
vdb-entrytechnical-description
https://vuldb.com/vuln/387213/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19359
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

changli (VulDB User)
VulDB CNA Team
.