CVE-2026-94384

Executive Summary

CVE-2026-94384 is a missing-authorization vulnerability (CWE-862) in Amazon's amazon-connect-salesforce-lambda integration before version 5.26. Any IAM principal holding lambda:InvokeFunction permission on the affected function can invoke a function that dispatches caller-supplied parameters to privileged AWS service APIs without validating authorization, thereby escalating privileges and performing AWS API operations that their own identity is explicitly denied. The impact is high for confidentiality and integrity (CVSS 8.1), and any AWS environment that has deployed the affected integration with the default or broadly-scoped invocation policy is at risk.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862): the code performs an action that requires an authorization check but omits that check entirely. In this specific case, the affected artifact is amazon-connect-salesforce-lambda, an AWS Lambda integration between Amazon Connect and Salesforce. The vulnerable component is a Lambda function that dispatches caller-supplied parameters to privileged service APIs. Because the function operates under an execution role with elevated AWS permissions, and because it fails to validate that the caller is authorized to perform the requested downstream operation, the authorization boundary between the caller's IAM identity and the Lambda's execution role collapses.

The attack surface is the AWS Lambda control plane. The NVD description explicitly states that the trigger condition is the lambda:InvokeFunction permission on the affected function. This permission is frequently granted broadly — for example, to all principals in an account, to a shared role, or via a resource-based policy that is wider than intended — so the effective privilege boundary is the Lambda's execution role rather than the caller's identity. The sfExecuteAWSService function is named in the remediation guidance as the specific function that must be deleted, disabled, or restricted; its purpose is to execute AWS service calls on behalf of the caller.

Because the function forwards caller-supplied parameters to privileged service APIs, the caller can select the target API and its parameters. Any operation the execution role is permitted to perform can therefore be reached through the function, even where the caller's own IAM identity is explicitly denied. The CVSS vector reflects low attack complexity, network attack vector, low privileges required, no user interaction, and high confidentiality and integrity impact, with no availability impact.

The exact parameter names, request schema, and downstream API set are not disclosed in the NVD description. No public proof-of-concept, Nuclei template, or exploit code is available; the mechanics above are inferred from the stated vulnerability class and the remediation guidance.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. An attacker with any foothold in the AWS account — a compromised developer credential, a low-privileged role obtained via SSRF or stolen keys — enumerates Lambda functions and their resource-based policies. The goal is to identify a deployed amazon-connect-salesforce-lambda instance and confirm the caller has or can obtain lambda:InvokeFunction on it.

2. Triggering the flaw. The attacker invokes the affected function through the Lambda Invoke API. Because the function performs no authorization validation on the caller-supplied parameters before dispatching them to privileged service APIs, the caller's own IAM policy — including explicit Deny statements — is never consulted. The missing authorization check is the entire exploit.

3. Execution method. The invocation payload supplies the parameters that the function forwards to the privileged downstream service API. The attacker selects the target API and the parameters that suit their objective; the function's execution role supplies the permissions. No fabricated endpoints or parameter names are required — the sole precondition is the ability to call the function.

4. Post-exploitation impact. The attacker acts with the Lambda execution role's privileges, which typically exceed their own. This supports privilege escalation and lateral movement across AWS: reading data from services the caller was denied, modifying resources, and potentially using the newly acquired permissions to reach further roles or services. The high confidentiality and integrity subscores reflect that both data exposure and unauthorized modification are possible.

Note the special case described in the remediation guidance: if the sfExecuteAWSService function is retained after setup, invocation should have been restricted to the intended IAM user. Environments that did not apply that restriction are the primary exposure.

Impact Assessment

The blast radius is the set of AWS API operations permitted to the Lambda execution role. Because the flaw converts lambda:InvokeFunction — a relatively common, often broadly granted permission — into the full privilege set of the execution role, a low-privileged insider or an external attacker with any account foothold can reach operations their identity is explicitly denied. CVSS 8.1 with AV:N/AC:L/PR:L/UI:N and S:U indicates a remotely reachable, low-complexity attack requiring only low privileges, contained to the vulnerable component's security scope but with high confidentiality and integrity impact. Availability is unaffected (I/A:N on availability). Business consequences include unauthorized disclosure of connected Salesforce and AWS data, integrity compromise of AWS resources, and a weakened audit trail because the actions execute under the integration's role rather than the attacker's identity.

Detection Guidance

Sigma Rule

title: Suspicious Invocation of amazon-connect-salesforce-lambda
id: 3f9c2a71-0b6d-4e21-9c58-1a7e6d4b2f90
status: experimental
description: Detects Lambda InvokeFunction calls against the amazon-connect-salesforce-lambda function from unexpected IAM principals
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94384
author: valtersit.com
date: 2026/01/01
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventSource: lambda.amazonaws.com
    eventName: Invoke
  selection_target:
    requestParameters|contains: 'amazon-connect-salesforce-lambda'
  filter_expected:
    userIdentity.arn|contains: 'intended-iam-user'
  condition: selection_event and selection_target and not filter_expected
falsepositives:
  - Legitimate integrations invoking the function under the documented intended IAM user
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078.004
  - cve.2026.94384

YARA Rule

rule CVE_2026_94384_Missing_Auth_Salesforce_Lambda
{
    meta:
        description = "Detects references to the vulnerable amazon-connect-salesforce-lambda function and sfExecuteAWSService dispatcher in source and deployment artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94384"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn = "amazon-connect-salesforce-lambda" ascii wide nocase
        $disp = "sfExecuteAWSService" ascii wide nocase
        $inv = "lambda:InvokeFunction" ascii wide nocase

    condition:
        uint16(0) == 0x0d0a or uint16(0) == 0x0a or
        (2 of ($fn, $disp) and $inv)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94384 Possible Invocation of amazon-connect-salesforce-lambda"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/2015-03-31/functions"; nocase; http.uri; content:"amazon-connect-salesforce-lambda"; nocase; http.header; content:"x-amz-target"; nocase; content:"Invoke"; nocase; classtype:attempted-privilege-escalation; reference:cve,2026-94384; sid:90094384; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [any where event.dataset == "aws.cloudtrail" and
       event.action == "Invoke" and
       process.name : "*amazon-connect-salesforce-lambda*" and
       user.id != "intended-iam-user"]

Splunk SPL Query

index=aws sourcetype=aws:cloudtrail eventSource=lambda.amazonaws.com eventName=Invoke
| where match(requestParameters, "amazon-connect-salesforce-lambda")
| where userIdentity.arn != "*intended-iam-user*"
| stats count min(_time) as first_seen max(_time) as last_seen by userIdentity.arn, sourceIPAddress, requestParameters
| sort -count

Wazuh OSSEC Rule

<group name="aws_cloudtrail,cve-2026-94384,">
  <rule id="100843" level="12">
    <decoded_as>json</decoded_as>
    <field name="eventSource">lambda.amazonaws.com</field>
    <field name="eventName">Invoke</field>
    <field name="requestParameters" type="pcre2">amazon-connect-salesforce-lambda</field>
    <description>CVE-2026-94384: Invocation of amazon-connect-salesforce-lambda by unauthorized principal</description>
    <mitre>
      <id>T1078.004</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Delete or disable the sfExecuteAWSService function. If it must remain, restrict invocation to the intended IAM user only via the Lambda resource-based policy and by narrowing lambda:InvokeFunction grants. Enumerate all principals currently permitted to invoke the affected function and remove any broad or unintended grants.

2. Patch/upgrade steps. Upgrade amazon-connect-salesforce-lambda to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If the function is retained, restrict invocation to the intended IAM user only.

3. Long-term hardening. Apply least privilege to the Lambda execution role so that even an unauthorized invocation cannot reach operations beyond its intended scope. Adopt a default-deny model for Lambda invoke permissions, monitor CloudTrail for invocations of the function by unexpected principals, and validate that the caller of any privileged dispatcher is itself authorized before forwarding parameters to downstream service APIs. Given patch confidence is 0/4, treat this as unpatched until a vendor-verified fix is confirmed in the environment.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94384
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• AWS Lambda security documentation: https://docs.aws.amazon.com/lambda/latest/dg/security.html
• AWS IAM best practices: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-94384 not listed as of this report; verify): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is available. No threat actor campaign or exploit-in-the-wild evidence has been identified for this CVE. This CVE is not currently in CISA KEV.