Missing Authorization in Amazon Connect Salesforce Lambda Function

CVE-2026-94384

What is CVE-2026-94384?

The Amazon Connect Salesforce Lambda function prior to version 5.26 has a missing authorization flaw that allows any IAM principal with the lambda:InvokeFunction permission to escalate their privileges. This vulnerability enables unauthorized access to perform AWS API operations that are typically denied to the caller’s IAM identity. The risk arises from the function's ability to execute Lambda calls with unvalidated user-supplied parameters, potentially exposing sensitive functionalities of privileged service APIs.

References