A critical security issue has been identified in AWS’s Amazon Connect Salesforce Lambda application, posing risks of unauthorized cloud operations. The flaw, designated as CVE-2026-94384, allows attackers to perform actions in the cloud beyond their allocated IAM permissions.
Affected Lambda Function and Versions
The vulnerability affects the sfExecuteAWSService Lambda function in AmazonConnectSalesforceLambda, specifically versions 5.15 through 5.24.16. This application is designed to facilitate the integration between Amazon Connect and Salesforce, providing a seamless connection for contact-center services.
During the initial setup phase, this Lambda function helps execute necessary AWS service operations. However, due to inadequate authorization checks, the function fails to confirm if a caller is authorized to request the AWS operations specified in its parameters.
Potential Security Risks
The flawed function can inadvertently send parameters controlled by the caller to AWS service APIs using its privileged execution role. This loophole creates a potential bypass of permission checks, allowing IAM users with lambda:InvokeFunction rights to execute operations that their IAM policies would typically restrict.
As a result, the vulnerable Lambda function could be exploited as a high-privilege proxy, enabling attackers to access AWS services, alter cloud resources, or perform actions allowed by the Lambda execution role. The severity of this issue depends on the permissions assigned to the function’s role and the available AWS APIs.
Mitigation and Recommendations
AWS has released a new version, AmazonConnectSalesforceLambda 5.26, to address the vulnerability. Organizations using affected versions are urged to upgrade immediately and reassess the necessity of the sfExecuteAWSService function post-integration.
Following setup, AWS advises disabling or deleting the sfExecuteAWSService function to prevent unnecessary exposure to privilege escalation. If it must remain active, access should be restricted to a single IAM user associated with the CTI Adapter, barring all other users and roles from invoking it.
To enhance security, organizations can implement AWS Service Control Policies or permission boundaries to explicitly deny invocation access for unauthorized principals. Configuring the SalesforceExecuteAWSServiceUser parameter to match the CTI Adapter’s IAM user can further limit cross-account invocation risks.
Conclusion and Future Outlook
Security teams are encouraged to verify the removal or disabling of the vulnerable function post-setup. Regular checks of IAM policies, Lambda resource policies, execution roles, and CloudTrail logs are vital to detect any unusual activities.
In recognition of the vulnerability’s discovery, AWS credited Chang Li from Xidian University, who reported the issue through a coordinated vulnerability disclosure process. This incident underscores the importance of vigilant security practices and timely updates to safeguard cloud environments.
