CVE-2026-19359 Overview
CVE-2026-19359 is an improper access control vulnerability [CWE-266] in the NXP Auto GoldVIP (gvip) project through version 1.4.0. The flaw resides in the SitewiseCustomFunction routine of the Lambda Function Handler component. Attackers can exploit it remotely over the network, but exploitation requires high privileges on the target environment.
The vendor confirmed this is a known historical IAM permission configuration issue, first addressed starting with GoldVIP 1.13.0 and further refined in 1.15.0. NXP has also requested that the AWS Serverless Application Repository (SAR) update or deprecate the older release.
Critical Impact
Successful exploitation grants limited unauthorized access to confidentiality, integrity, and availability of resources managed through the affected Lambda handler due to over-permissioned IAM configuration.
Affected Products
- NXP Auto GoldVIP (gvip) up to version 1.4.0
- AWS Lambda Function Handler component (SitewiseCustomFunction)
- Deployments sourced from the AWS SAR application repository predating GoldVIP 1.13.0
Discovery Timeline
- 2026-08-09 - CVE-2026-19359 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19359
Vulnerability Analysis
The vulnerability originates in the SitewiseCustomFunction Lambda handler bundled with NXP Auto GoldVIP. The handler executes with an IAM role whose permission set exceeds the scope required for its intended operations. This over-permissioning falls under [CWE-266: Incorrect Privilege Assignment].
A remote authenticated actor with high privileges can invoke the function or leverage the associated IAM role to reach AWS resources outside the intended trust boundary. The vendor classifies the issue as historical, resolved in 1.13.0 and subsequent releases including 1.15.0.
No public exploit code has been published for CVE-2026-19359, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.36%.
Root Cause
The root cause is an IAM policy attached to the SitewiseCustomFunction Lambda role that grants broader permissions than the function requires. Because IAM policies define the effective privilege of Lambda executions, misconfigured statements allow the function to perform actions on AWS Sitewise and adjacent services that should be denied by least-privilege design.
Attack Vector
Exploitation requires network access and authenticated privileges high enough to invoke or influence the Lambda handler. No user interaction is required. Once triggered, the function operates under its over-permissioned role, allowing the attacker to indirectly perform actions that the caller would not otherwise be authorized to execute.
Because no verified proof-of-concept code is available, defenders should reference the GitHub Release Note for GoldVIP 1.15.0 and the VulDB Vulnerability Details for technical context.
Detection Methods for CVE-2026-19359
Indicators of Compromise
- Invocations of SitewiseCustomFunction originating from unexpected principals or IP ranges recorded in AWS CloudTrail
- AssumeRole events for the GoldVIP Lambda execution role followed by API calls outside the Sitewise service scope
- Deployments of GoldVIP SAR applications with a version string at or below 1.4.0
Detection Strategies
- Audit CloudTrail for lambda:InvokeFunction events against SitewiseCustomFunction and correlate with the caller identity and source IP.
- Run IAM Access Analyzer against the GoldVIP Lambda role to surface unused or overly broad permission statements.
- Inventory deployed SAR applications and flag any GoldVIP release below 1.13.0.
Monitoring Recommendations
- Enable AWS Config rules that detect Lambda functions attached to permissive IAM policies containing wildcard actions or resources.
- Stream CloudTrail and IAM events to a centralized analytics tier such as Amazon GuardDuty or an equivalent SIEM for anomaly detection.
- Set alerts on privilege-escalation patterns such as iam:PassRole or sts:AssumeRole calls tied to the GoldVIP Lambda role.
How to Mitigate CVE-2026-19359
Immediate Actions Required
- Upgrade NXP Auto GoldVIP to version 1.15.0 or later using the official release.
- Identify and remove any GoldVIP deployments sourced from AWS SAR at versions below 1.13.0.
- Rotate credentials and review CloudTrail logs for suspicious invocations of SitewiseCustomFunction prior to remediation.
Patch Information
NXP addressed the IAM permission configuration beginning with GoldVIP 1.13.0, with further refinements in subsequent releases including 1.15.0. NXP has requested that the AWS SAR application repository update or deprecate older releases. Details are available in the GitHub Release Note.
Workarounds
- Manually restrict the IAM policy attached to the SitewiseCustomFunction Lambda role to the minimum actions and resources required for operation.
- Apply resource-based policies and service control policies (SCPs) to constrain the Lambda role from calling services beyond AWS IoT Sitewise.
- Disable or delete the SitewiseCustomFunction deployment if the GoldVIP feature is not in active use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
