CVE-2024-28056
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed, a Condition property is removed but 'Effect':'Allow' remains, making sts:AssumeRoleWithWebIdentity available without conditions.
Risk Assessment
An attacker could exploit this to assume a role and gain unauthorized access to an organization's AWS resources, if an authorized AWS user previously removed the Authentication component.
Recommendation
Update AWS Amplify CLI to version 12.10.1 or later and review existing Amplify projects for incorrectly configured IAM role trust policies.
Related vulnerabilities
- CVE-2026-75430Critical
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port, allowing a remote attacker to execute arbitrary code.
- CVE-2026-75431Critical
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication, allowing a remote attacker to execute arbitrary code.
- CVE-2026-44402Critical
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint, allowing remote attackers to execute arbitrary commands as root by uploading a crafted tar archive.
- CVE-2026-19274Critical
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects keyed solely by the bare CR name with no namespace disambiguation.
- CVE-2026-18658Critical
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
- CVE-2026-85696Critical
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.
- CVE-2026-85695Critical
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports.
- CVE-2026-85688Critical
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code execution.
- CVE-2026-85684Critical
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames with directory traversal sequences to write arbitrary files or delete existing files.
- CVE-2026-85672Critical
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands. Attackers can craft URLs with malicious extensions to execute arbitrary OS commands.
Original NVD description (English source)
Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.