CVE-2026-86516

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86516", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-07T19:23:05.914Z", "datePublished": "2026-09-08T03:15:09.819Z", "dateUpdated": "2026-09-08T12:27:40.870Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-08T03:15:09.819Z"}, "title": "elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "Improper Privilege Management"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "elenavanengelenmaslova", "product": "mocknest-serverless", "versions": [{"version": "0.9.0", "status": "affected"}], "cpes": ["cpe:2.3:a:elenavanengelenmaslova:mocknest-serverless:*:*:*:*:*:*:*:*"], "modules": ["AWS GitHub OIDC Deployment Helper Script"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-07T21:28:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "changli (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/399670", "name": "VDB-399670 | elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/399670/cti", "name": "VDB-399670 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-86516", "name": "CVE-2026-86516 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/908568", "name": "Submit #908568 | elenavanengelenmaslova mocknest-serverless 0.9.0 Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b", "tags": ["patch"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T12:27:17.813491Z", "id": "CVE-2026-86516", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T12:27:40.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86516", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T12:27:17.813491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T12:27:23.570Z"}}], "cna": {"tags": ["x_open-source"], "title": "elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management", "credits": [{"lang": "en", "type": "reporter", "value": "changli (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:elenavanengelenmaslova:mocknest-serverless:*:*:*:*:*:*:*:*"], "vendor": "elenavanengelenmaslova", "modules": ["AWS GitHub OIDC Deployment Helper Script"], "product": "mocknest-serverless", "versions": [{"status": "affected", "version": "0.9.0"}]}], "timeline": [{"lang": "en", "time": "2026-09-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-07T21:28:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/399670", "name": "VDB-399670 | elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/399670/cti", "name": "VDB-399670 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-86516", "name": "CVE-2026-86516 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/908568", "name": "Submit #908568 | elenavanengelenmaslova mocknest-serverless 0.9.0 Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b", "tags": ["patch"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-08T03:15:09.819Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86516", "state": "PUBLISHED", "dateUpdated": "2026-09-08T12:27:40.870Z", "dateReserved": "2026-09-07T19:23:05.914Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-08T03:15:09.819Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:elenavanengelenmaslova:mocknest-serverless:*:*:*:*:*:*:*:*"], "modules": ["AWS GitHub OIDC Deployment Helper Script"], "product": "mocknest-serverless", "vendor": "elenavanengelenmaslova", "versions": [{"status": "affected", "version": "0.9.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en elenavanengelenmaslova mocknest-serverless 0.9.0. El elemento afectado es una funci\u00f3n desconocida del archivo deployment/aws/shared/github-oidc-role.yaml del componente AWS GitHub OIDC Deployment Helper Script. Realizar una manipulaci\u00f3n resulta en una gesti\u00f3n de privilegios inadecuada. Es posible iniciar el ataque remotamente. El parche se llama 6ab3147282d867c1993f995272750db091c2290b. Aplicar un parche es la acci\u00f3n recomendada para solucionar este problema."}], "id": "CVE-2026-86516", "lastModified": "2026-09-23T11:10:00.187", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86516", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T12:27:17.813491Z", "version": "2.0.3"}}]}, "published": "2026-09-08T04:17:42.030", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/"}, {"source": "cna@vuldb.com", "url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/commit/6ab3147282d867c1993f995272750db091c2290b"}, {"source": "cna@vuldb.com", "url": "https://github.com/elenavanengelenmaslova/mocknest-serverless/pull/254"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-86516"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/908568"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/399670"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/399670/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.9.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mocknest-serverless", "source": "cna", "vendor": "elenavanengelenmaslova"}, "product": "mocknest-serverless", "vendor": "elenavanengelenmaslova"}], "created": "2026-09-08T04:30:07.179202+00:00", "title": "Improper Privilege Management in AWS GitHub OIDC Deployment Helper Script", "updated": "2026-09-08T20:35:51.022990+00:00", "vendors": ["elenavanengelenmaslova", "elenavanengelenmaslova$PRODUCT$mocknest-serverless"]}