Quick answers
- Is CVE-2026-115414 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115414 being exploited in the wild.
- How severe is CVE-2026-115414?
- High severity, with a CVSS score of 7.8, published 22 October 2026.
- Which products and versions are affected?
- AWS SAM CLI >=1.63.0, <=1.166.1.
- Is there a fix for CVE-2026-115414?
- Yes: fixed in AWS SAM CLI v1.166.2. Until then: Ensure that Terraform configuration files and plan files consumed by sam build --hook-name terraform come only from trusted sources, and audit third-party Terraform modules and shared repositories that supply input to the build. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115414 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-115414?
- Check whether you run Amazon AWS or AWS SAM CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: AWS SAM CLI v1.166.2
Ensure that Terraform configuration files and plan files consumed by sam build --hook-name terraform come only from trusted sources, and audit third-party Terraform modules and shared repositories that supply input to the build.
Technical details
The Terraform hook in sam build --hook-name terraform generates Makefile recipes that interpolate Terraform resource addresses without neutralizing shell metacharacters, enabling OS command injection. An attacker who can influence the Terraform configuration or plan file consumed by the build can execute arbitrary code as the build user. The vulnerability affects versions 1.63.0 through 1.166.1 and is fixed in version 1.166.2.
Affected products
- AWS SAM CLI >=1.63.0, <=1.166.1
Timeline
- 2026-10-22: disclosed