Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26

CVE-2026-94384 is a missing-authorization flaw in the sfExecuteAWSService Lambda function shipped with Amazon's Connect–Salesforce integration package (AmazonConnectSalesforceLambda). Versions 5.15 through 5.24.16 are affected. The function accepts caller-controlled parameters and dispatches them to AWS service APIs using the Lambda's own privileged execution role — without checking whether the invoking IAM principal is authorized for those operations. Any principal with lambda:InvokeFunction on this specific function can escalate to perform actions their own IAM policy explicitly denies. The fix is version 5.26, released 2026-09-22. Researcher Chang Li of Xidian University discovered and reported the issue through coordinated disclosure.

The vendor rates this HIGH / 8.1 on CVSS v3.1, but the v4.0 re-score from the GHSA advisory drops it to 6.4 MEDIUM — and reality supports the lower number. The function is a *setup utility*: AWS's own documentation tells customers to delete or disable sfExecuteAWSService the moment initial configuration finishes. The product itself is a niche contact-center integration used by the subset of AWS customers running both Amazon Connect *and* Salesforce. Exploitation requires pre-existing AWS IAM credentials, and the blast radius is capped by whatever permissions the Lambda execution role was granted — typically scoped to Connect/Salesforce integration tasks, not account-wide admin. The 8.1 treats this as a generic network-accessible escalation and ignores every one of those narrowing factors.

1. Delete or disable the sfExecuteAWSService Lambda function immediately — AWS recommends this as standard post-setup hygiene. If the function does not exist, the vulnerability is fully neutralized regardless of version. This is the fastest and most complete mitigation. As a MEDIUM-severity finding under the noisgate mitigation SLA, there is no formal mitigation deadline — go straight to the 365-day remediation window. However, deleting the function takes minutes and costs nothing; do it now.
2. Restrict lambda:InvokeFunction via resource-based policy — If the function must remain active, update its resource-based policy to allow invocation *only* from the specific IAM role or user used by the Salesforce CTI Adapter. Deny all other principals. This prevents any other identity from reaching the vulnerable code path.
3. Apply permission boundaries to the Lambda execution role — Attach an IAM permission boundary to the Lambda's execution role that restricts it to only the AWS APIs required for the Connect–Salesforce integration. This caps the blast radius even if the authorization bypass is exploited.
4. Upgrade to AmazonConnectSalesforceLambda v5.26 — The patched version adds proper authorization validation to sfExecuteAWSService. Deploy via the AWS Serverless Application Repository update mechanism. Under the noisgate remediation SLA for MEDIUM, complete within 365 days — but given the trivial effort, prioritize within your next change window.
5. Enable CloudTrail alerting on the Lambda function ARN — Create a CloudWatch Events rule or SIEM correlation that alerts on any lambda:Invoke call targeting the sfExecuteAWSService function. This provides detection coverage while remediation is in progress.

Run this script from any workstation with the AWS CLI configured and IAM permissions for lambda:ListFunctions and lambda:GetFunction in the target account. Invoke with: bash check_cve_2026_94384.sh [--region us-east-1]. Requires read-only IAM access; does not invoke the vulnerable function.

#!/usr/bin/env bash
# check_cve_2026_94384.sh — Detect CVE-2026-94384 exposure
# Checks whether sfExecuteAWSService Lambda exists and is on a vulnerable version.
# Exit codes: 0=PATCHED/not-present, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

REGION="${1:---region us-east-1}"
if [[ "$REGION" == --region ]]; then
  REGION_FLAG=""
else
  REGION_FLAG="--region ${REGION#--region }"
fi

echo "[*] Scanning for sfExecuteAWSService Lambda function..."

# Find functions matching the name pattern
MATCHES=$(aws lambda list-functions $REGION_FLAG \
  --query "Functions[?contains(FunctionName, 'sfExecuteAWSService')].FunctionName" \
  --output text 2>/dev/null || true)

if [[ -z "$MATCHES" || "$MATCHES" == "None" ]]; then
  echo "PATCHED — sfExecuteAWSService function not found in this account/region."
  echo "The function was either never deployed or has been deleted (best practice)."
  exit 0
fi

VULN_FOUND=0
for FUNC_NAME in $MATCHES; do
  echo "[*] Found function: $FUNC_NAME"

  # Check if function is active
  STATE=$(aws lambda get-function $REGION_FLAG \
    --function-name "$FUNC_NAME" \
    --query "Configuration.State" --output text 2>/dev/null || echo "UNKNOWN")

  if [[ "$STATE" == "Inactive" ]]; then
    echo "    State: Inactive (disabled) — not currently exploitable."
    continue
  fi

  # Try to extract version from environment variables or description
  DESC=$(aws lambda get-function $REGION_FLAG \
    --function-name "$FUNC_NAME" \
    --query "Configuration.Description" --output text 2>/dev/null || echo "")

  ENV_VERSION=$(aws lambda get-function-configuration $REGION_FLAG \
    --function-name "$FUNC_NAME" \
    --query "Environment.Variables.SF_ADAPTER_VERSION" --output text 2>/dev/null || echo "None")

  echo "    State: $STATE"
  echo "    Description: $DESC"
  echo "    Adapter version (env): $ENV_VERSION"

  # Check for the fix commit or version indicator in the code
  if [[ "$ENV_VERSION" != "None" && "$ENV_VERSION" != "" ]]; then
    # Compare version — vulnerable: 5.15 through 5.24.16, fixed: 5.26+
    MAJOR=$(echo "$ENV_VERSION" | cut -d. -f1)
    MINOR=$(echo "$ENV_VERSION" | cut -d. -f2)
    if [[ "$MAJOR" -eq 5 && "$MINOR" -ge 15 && "$MINOR" -le 25 ]]; then
      echo "VULNERABLE — $FUNC_NAME is on version $ENV_VERSION (affected range: 5.15–5.24.16)."
      echo "    Action: Delete this function or upgrade to v5.26+."
      VULN_FOUND=1
    elif [[ "$MAJOR" -ge 6 || ("$MAJOR" -eq 5 && "$MINOR" -ge 26) ]]; then
      echo "PATCHED — $FUNC_NAME is on version $ENV_VERSION (fixed in 5.26)."
    else
      echo "PATCHED — $FUNC_NAME is on version $ENV_VERSION (pre-5.15, not affected)."
    fi
  else
    echo "UNKNOWN — Could not determine version for $FUNC_NAME."
    echo "    Recommend: verify manually or delete the function if no longer needed."
    VULN_FOUND=2
  fi
done

if [[ $VULN_FOUND -eq 1 ]]; then
  echo ""
  echo "VULNERABLE — One or more sfExecuteAWSService functions are on affected versions."
  exit 1
elif [[ $VULN_FOUND -eq 2 ]]; then
  echo ""
  echo "UNKNOWN — Function found but version could not be confirmed."
  exit 2
else
  echo ""
  echo "PATCHED — All detected functions are on patched or unaffected versions."
  exit 0
fi

1. AWS Security Advisory / CybersecurityNews coverage
2. OSV — CVE-2026-94384
3. OffSeq Threat Radar — CVE-2026-94384
4. TheHackerWire — CVE-2026-94384 (PoC Available)
5. GitHub — amazon-connect-salesforce-lambda repository
6. Strix.ai — CVE-2026-94384 analysis
7. Shenlong CVE Platform — CVE-2026-94384 advisory