CVE-2026-115414 AWS CVE debrief

Who should care

Build and deployment teams using AWS SAM CLI versions before 1.166.2 should assess exposure and prioritize upgrading to version 1.166.2 or later. The vulnerability allows an actor to execute arbitrary commands as the build user, potentially compromising build hosts. Teams should review Terraform configuration and plan files, verify build logs for suspicious activity, and upgrade to the fixed version.

Why it matters

The OS command injection vulnerability in the Terraform hook of AWS SAM CLI versions before 1.166.2 allows an actor to execute arbitrary commands as the build user, potentially compromising build hosts. Build and deployment teams should assess exposure and prioritize upgrading to version 1.166.2 or later. Verification of Terraform configuration and plan files is necessary, and remediation requires upgrading to the fixed version.

• Potential execution of arbitrary commands as the build user.
• Possible compromise of build hosts.
• Verification of Terraform configuration and plan files is necessary.
• Upgrade to version 1.166.2 or later is required for remediation.

Technical summary

The AWS SAM CLI before version 1.166.2 contains an OS command injection vulnerability in the Terraform hook. An actor who can influence the Terraform configuration or plan file can execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. The vulnerability is due to insufficient validation of user input in the Terraform hook. The CVE record and source item provide details on the vulnerability. Verification of Terraform configuration and plan files is necessary, and remediation requires upgrading to the fixed version.

Defensive priority

High priority for build and deployment teams using AWS SAM CLI versions before 1.166.2.

Recommended defensive actions

• Upgrade to AWS SAM CLI version 1.166.2 or later.
• Review and update build configurations to ensure Terraform configuration and plan files are validated.
• Monitor build logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in the Terraform hook of AWS SAM CLI versions before 1.166.2. The vulnerability allows an actor to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. Verification of Terraform configuration and plan files is necessary, and remediation requires upgrading to the fixed version. The source detail is limited, so explicit evidence-limit language and defensive verification tasks are needed

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.