CVE-2026-19360: ExcelLexBot Privilege Escalation Flaw

CVE-2026-19360 Overview

CVE-2026-19360 is an improper privilege management vulnerability [CWE-266] in wongcyrus ExcelLexBot versions up to 0.0.3. The flaw resides in the ExcelLexBotS3TriggerFunction within the Lambda Function Handler component. An attacker can manipulate the function remotely to gain privileges beyond those intended for the caller. The vendor was contacted about the disclosure but did not respond. The affected software is no longer supported by the maintainer, so no patch is expected.

Critical Impact
Remote attackers holding limited privileges can abuse the ExcelLexBotS3TriggerFunction Lambda handler to escalate access within the AWS execution context, affecting confidentiality, integrity, and availability of resources the function can reach.

Affected Products

wongcyrus ExcelLexBot versions up to and including 0.0.3
ExcelLexBot Lambda Function Handler component (ExcelLexBotS3TriggerFunction)
Deployments using unsupported ExcelLexBot releases in AWS environments

Discovery Timeline

2026-08-09 - CVE-2026-19360 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in the NVD database

Technical Details for CVE-2026-19360

Vulnerability Analysis

ExcelLexBot is a tool that generates Amazon Lex chatbots from Excel spreadsheets and provisions supporting AWS Lambda functions. The ExcelLexBotS3TriggerFunction handler processes S3 events tied to spreadsheet uploads. The handler operates without enforcing least-privilege controls, allowing an authenticated caller to invoke actions the function should not expose. Because the Lambda role typically holds broad permissions to create Lex bots and related resources, misuse of the handler translates directly into control over provisioning workflows.

The CWE-266 classification describes situations where a system grants a subject more privileges than required. In this case, the trigger function inherits an execution role that is not appropriately scoped, and the handler logic does not validate that the invoker is authorized to trigger the sensitive operations it performs.

Root Cause

The root cause is improper privilege management within the Lambda Function Handler. The ExcelLexBotS3TriggerFunction accepts event input and executes privileged operations without adequate authorization checks or a narrowly scoped IAM role. When combined, these weaknesses let a caller with high privileges of their own reach functionality that should remain restricted, producing a privilege management failure across the deployment.

Attack Vector

The attack vector is network-based. An attacker with high privileges but no user interaction requirement can craft input that reaches the ExcelLexBotS3TriggerFunction handler. The manipulation causes the Lambda function to perform actions using its overly permissive execution role. The EPSS score is 0.218% with a percentile of 12.423, indicating a low but non-zero probability of exploitation activity in the near term.

No verified public proof-of-concept code is available. For technical details, refer to the VulDB entry for CVE-2026-19360 and the associated VulDB vulnerability record #387214.

Detection Methods for CVE-2026-19360

Indicators of Compromise

Unexpected invocations of ExcelLexBotS3TriggerFunction originating from principals that do not normally upload spreadsheets to the monitored S3 bucket.
CloudTrail entries showing Lex bot creation, update, or deletion actions performed by the ExcelLexBot Lambda execution role outside of expected change windows.
S3 PutObject events targeting the ExcelLexBot trigger bucket from unusual source IP addresses or IAM identities.

Detection Strategies

Enable AWS CloudTrail data events for the S3 bucket that fronts ExcelLexBot and forward logs to a central analytics platform for correlation.
Baseline the normal callers, source IPs, and object keys that legitimately trigger ExcelLexBotS3TriggerFunction, and alert on deviations.
Correlate Lambda invocation logs with the actions taken by the function's IAM role to identify privilege abuse patterns matching CWE-266.

Monitoring Recommendations

Stream CloudWatch Logs from the ExcelLexBot Lambda function into a SIEM and alert on error patterns or unexpected role assumptions.
Track IAM Access Analyzer findings for the ExcelLexBot execution role to surface unused permissions that widen the blast radius.
Monitor Amazon Lex management API calls for changes not tied to an authorized deployment pipeline.

How to Mitigate CVE-2026-19360

Immediate Actions Required

Inventory all AWS accounts for deployments of wongcyrus ExcelLexBot at version 0.0.3 or earlier and remove them where they are not required.
Restrict the IAM execution role attached to ExcelLexBotS3TriggerFunction to only the specific Lex, S3, and logging actions required for operation.
Apply an S3 bucket policy that limits PutObject and event-generating operations to a narrow set of trusted principals.

Patch Information

No patch is available. The maintainer has ended support for ExcelLexBot, and the vendor did not respond to disclosure. Organizations should treat the software as unsupported and plan migration to an actively maintained alternative for generating Amazon Lex bots.

Workarounds

Disable or remove the S3 event notification that invokes ExcelLexBotS3TriggerFunction until the deployment can be decommissioned.
Replace the Lambda execution role with a policy that denies privileged Lex, IAM, and CloudFormation actions the function does not require.
Place the trigger bucket behind a VPC endpoint with an endpoint policy that restricts which principals can write objects.

bash

# Configuration example: remove the S3 trigger and detach broad permissions
aws lambda delete-event-source-mapping \
  --uuid <event-source-mapping-uuid>

aws s3api put-bucket-notification-configuration \
  --bucket <excellexbot-bucket> \
  --notification-configuration '{}'

aws iam detach-role-policy \
  --role-name ExcelLexBotS3TriggerFunctionRole \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess