CVE-2026-86516: Improper Privilege Management in elenavanengelenmaslova mocknest-serverless

This vulnerability affects elenavanengelenmaslova mocknest-serverless version 0.9.0 and is located in an unknown function of the file deployment/aws/shared/github-oidc-role.yaml, part of the AWS GitHub OIDC Deployment Helper Script. The issue results in improper privilege management, which can be triggered remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. A patch is available under commit 6ab3147282d867c1993f995272750db091c2290b. The product is a cloud service, so remediation is typically managed by the vendor.

The vulnerability allows improper privilege management, which could lead to unauthorized privilege escalation or misuse of permissions in the affected AWS GitHub OIDC deployment context. Since the attack can be initiated remotely, it poses a risk to environments using the vulnerable version 0.9.0 of mocknest-serverless. However, no known exploits are reported in the wild at this time.

A patch identified by commit 6ab3147282d867c1993f995272750db091c2290b is available and should be applied to remediate this vulnerability. As this is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory for the current patch status and ensure their deployment is updated accordingly.