CVE-2026-86516

A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue.

CVSS v3 4.7 MEDIUM
CVSS v2.0 5.8 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:M/C:P/I:P/A:P

Exploitability : 6.4 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/elenavanengelenmaslova/mocknest-serverless/
https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b
https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254
https://vuldb.com/cve/CVE-2026-86516
https://vuldb.com/submit/908568
https://vuldb.com/vuln/399670
https://vuldb.com/vuln/399670/cti

Configurations

No configuration.

History

23 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue detectada en elenavanengelenmaslova mocknest-serverless 0.9.0. El elemento afectado es una función desconocida del archivo deployment/aws/shared/github-oidc-role.yaml del componente AWS GitHub OIDC Deployment Helper Script. Realizar una manipulación resulta en una gestión de privilegios inadecuada. Es posible iniciar el ataque remotamente. El parche se llama 6ab3147282d867c1993f995272750db091c2290b. Aplicar un parche es la acción recomendada para solucionar este problema.

Information

Published : 2026-09-08 04:17

Updated : 2026-09-23 11:10

NVD link : CVE-2026-86516

Mitre link : CVE-2026-86516

CVE.ORG link : CVE-2026-86516

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

CWE-269

Improper Privilege Management

{"id": "CVE-2026-86516", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86516", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T12:27:17.813491Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "authentication": "MULTIPLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:elenavanengelenmaslova:mocknest-serverless:*:*:*:*:*:*:*:*"], "vendor": "elenavanengelenmaslova", "modules": ["AWS GitHub OIDC Deployment Helper Script"], "product": "mocknest-serverless", "versions": [{"status": "affected", "version": "0.9.0"}]}]}], "published": "2026-09-08T04:17:42.030", "references": [{"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/", "source": "cna@vuldb.com"}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b", "source": "cna@vuldb.com"}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-86516", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/908568", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/399670", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/399670/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en elenavanengelenmaslova mocknest-serverless 0.9.0. El elemento afectado es una funci\u00f3n desconocida del archivo deployment/aws/shared/github-oidc-role.yaml del componente AWS GitHub OIDC Deployment Helper Script. Realizar una manipulaci\u00f3n resulta en una gesti\u00f3n de privilegios inadecuada. Es posible iniciar el ataque remotamente. El parche se llama 6ab3147282d867c1993f995272750db091c2290b. Aplicar un parche es la acci\u00f3n recomendada para solucionar este problema."}], "lastModified": "2026-09-23T11:10:00.187", "sourceIdentifier": "cna@vuldb.com"}