Executive brief
MockNest Serverless is a serverless mock runtime for AWS Lambda that enables integration testing without live external services. A misconfiguration in the AWS GitHub OIDC deployment helper script allows improper privilege escalation, potentially enabling unauthorized deployments or access to AWS resources if the OIDC role is exploited.
Technical details
This vulnerability involves improper privilege management in the AWS GitHub OIDC Deployment Helper Script (deployment/aws/shared/github-oidc-role.yaml) in MockNest Serverless 0.9.0. The issue stems from overly broad IAM permissions assigned to the GitHub OIDC role, which violates the principle of least privilege. The vulnerability can be exploited remotely by an attacker who can trigger GitHub Actions workflows or forge OIDC tokens. By manipulating the OIDC configuration, an attacker could escalate privileges and gain unauthorized access to AWS resources. The patch (commit 6ab3147) hardens the OIDC configuration by restricting deployments to the main branch, replacing broad permissions with scoped IAM permissions, and adding dedicated execution roles. Applying the patch is recommended.
Affected products
- elenavanengelenmaslova MockNest Serverless 0.9.0
Timeline
- 2026-09-08: disclosed: CVE-2026-86516 published to NVD
- 2026-05-29: patched: Patch released via commit 6ab3147282d867c1993f995272750db091c2290b