EUVD-2026-72639
GHSA-4h3p-r584-fm85
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H required (repo dispatch access); C:L/I:L reflects IAM role assumption with limited scope; A:N as no availability impact identified.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Improper privilege management in mocknest-serverless 0.9.0 exposes AWS IAM role assumption to unauthorized escalation through a hardcoded default OIDC role name in GitHub Actions workflow dispatch inputs. The affected GitHub Actions workflows defaulted to a predictable IAM role name ('GitHubOIDCAdmin') combined with an overly permissive OIDC trust policy using wildcard StringLike conditions and PowerUserAccess grants, allowing any user with repository dispatch access to assume an admin-level AWS IAM role beyond their intended scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) write or workflow dispatch permission on the affected GitHub repository - this is not a publicly accessible endpoint; (2) the target AWS account must have an IAM role named 'GitHubOIDCAdmin' with an OIDC trust policy that accepts the repository's GitHub Actions identity, using permissive StringLike wildcard conditions (the old template configuration); (3) the vulnerable workflow files (deploy-on-demand.yml, main-aws.yml, sar-publish.yml) must still be present with the hardcoded default role name unpatched. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 with PR:H is well-calibrated for this vulnerability: exploitation is gated on possessing repository write or workflow dispatch access, which limits the realistic attacker pool to trusted collaborators or those who have compromised such an account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit 6ab3147282d867c1993f995272750db091c2290b or merge PR #254 from the GitHub repository (https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today