Threats affecting pkg:github/amazon-connect/amazon-connect-salesforce-lambda

CVE-2026-94384 is a high-severity vulnerability in Amazon's amazon-connect-salesforce-lambda versions 5.15 through 5.24.16. It involves missing authorization checks in a Lambda function (sfExecuteAWSService) that allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges. This escalation enables performing AWS API operations that the caller's IAM identity is explicitly denied. The issue is resolved in version 5.26 and later by removing or restricting the vulnerable function.