CVE-2026-86516: mocknest-serverless Privilege Escalation

CVE-2026-86516 Overview

CVE-2026-86516 is an improper privilege management vulnerability [CWE-266] affecting elenavanengelenmaslova/mocknest-serverless version 0.9.0. The flaw resides in the deployment/aws/shared/github-oidc-role.yaml file, part of the AWS GitHub OpenID Connect (OIDC) Deployment Helper Script. The trust policy generated by this component is overly permissive, allowing GitHub Actions workflows from branches beyond main to assume the associated AWS Identity and Access Management (IAM) role. An authenticated actor with elevated privileges can leverage this misconfiguration remotely to obtain AWS access intended only for trusted deployment pipelines.

Critical Impact
A permissive OIDC trust policy permits non-main branches and pull requests to assume the AWS IAM deployment role, expanding the blast radius of any compromised or malicious workflow.

Affected Products

elenavanengelenmaslova/mocknest-serverless version 0.9.0
Component: AWS GitHub OIDC Deployment Helper Script
File: deployment/aws/shared/github-oidc-role.yaml

Discovery Timeline

2026-09-08 - CVE-2026-86516 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86516

Vulnerability Analysis

The vulnerability stems from an overly broad AWS IAM trust policy scaffolded by the mocknest-serverless deployment helper. GitHub Actions workflows authenticate to AWS through OIDC, exchanging a signed workflow token for temporary IAM credentials. The trust policy dictates which workflows and branches are permitted to complete this exchange. In version 0.9.0, the generated policy does not restrict the sub claim tightly enough, so feature branches, bugfix branches, hotfix branches, and pull request workflows can all assume the deployment role. Any contributor able to trigger a workflow on such a branch inherits AWS privileges scoped for production deployment.

Root Cause

The root cause is improper privilege management [CWE-266] in the OIDC trust relationship. The github-oidc-role.yaml CloudFormation template did not constrain the OIDC subject claim to a specific branch reference such as repo:owner/mocknest-serverless:ref:refs/heads/main. Without that constraint, AWS Security Token Service (STS) accepts assume-role requests originating from unintended workflow contexts.

Attack Vector

Exploitation requires network access and prior high privileges, such as the ability to push a branch or open a pull request against the target repository. The actor triggers a GitHub Actions workflow that calls aws-actions/configure-aws-credentials, receives an OIDC token, and swaps it for AWS credentials tied to the deployment role. The resulting session inherits the role's IAM permissions and can act against the AWS account outside of the sanctioned release process.

bash

 BLUE='\033[0;34m'
 NC='\033[0m' # No Color
 
+echo ""
+echo -e "${RED}╔══════════════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${RED}║                        ⚠️  SECURITY WARNING                         ║${NC}"
+echo -e "${RED}╠══════════════════════════════════════════════════════════════════════╣${NC}"
+echo -e "${RED}║ This script updates the OIDC trust policy for your AWS IAM role.   ║${NC}"
+echo -e "${RED}║ The trust policy controls which GitHub Actions workflows can        ║${NC}"
+echo -e "${RED}║ assume this role and access your AWS account.                       ║${NC}"
+echo -e "${RED}║                                                                    ║${NC}"
+echo -e "${RED}║ This hardened policy trusts ONLY the main branch.                  ║${NC}"
+echo -e "${RED}║ Feature, bugfix, hotfix branches and pull requests are excluded.   ║${NC}"
+echo -e "${RED}╚══════════════════════════════════════════════════════════════════════╝${NC}"
+echo ""
 echo -e "${BLUE}🔧 Updating existing GitHub Actions OIDC role for MockNest Serverless${NC}"
 echo ""

Source: GitHub Commit 6ab3147. The patch introduces a hardened trust policy that restricts role assumption to the main branch only.

Detection Methods for CVE-2026-86516

Indicators of Compromise

AWS CloudTrail AssumeRoleWithWebIdentity events where the OIDC sub claim references branches other than refs/heads/main for the mocknest-serverless deployment role.
Unexpected STS session activity outside of scheduled release windows or originating from pull request or feature branch workflow runs.
IAM role trust policies in deployed environments still referencing wildcard or unrestricted GitHub subject claims after patch availability.

Detection Strategies

Inventory all IAM roles created by the github-oidc-role.yaml template and audit their Condition blocks for the presence of a token.actions.githubusercontent.com:sub constraint scoped to main.
Correlate GitHub Actions workflow run logs with CloudTrail AssumeRoleWithWebIdentity events to identify assumptions initiated from non-production branches.
Compare deployed CloudFormation stacks against commit 6ab3147282d867c1993f995272750db091c2290b to confirm the hardened trust policy is in place.

Monitoring Recommendations

Enable AWS CloudTrail in all regions and forward events to a SIEM to alert on AssumeRoleWithWebIdentity calls with unexpected sub values.
Configure IAM Access Analyzer to flag trust policies that grant access to external principals without branch scoping.
Monitor GitHub repository settings for changes to branch protection and workflow permissions that could enable abuse of the OIDC integration.

How to Mitigate CVE-2026-86516

Immediate Actions Required

Apply the upstream patch by updating mocknest-serverless past commit 6ab3147282d867c1993f995272750db091c2290b.
Redeploy or manually edit any existing IAM role trust policy created from github-oidc-role.yaml to restrict token.actions.githubusercontent.com:sub to repo:<owner>/mocknest-serverless:ref:refs/heads/main.
Rotate any AWS credentials or session tokens issued through the affected role and review recent CloudTrail activity for unauthorized use.

Patch Information

The maintainer merged the fix in Pull Request #254 via commit 6ab3147282d867c1993f995272750db091c2290b. The hardened trust policy trusts only the main branch and explicitly excludes feature, bugfix, hotfix branches, and pull request workflows. Additional context is available in the VulDB CVE Analysis.

Workarounds

Manually edit the IAM role trust policy to add a StringEquals condition on the OIDC sub claim that permits only the main branch reference.
Apply GitHub branch protection rules and require review before any workflow with OIDC access to AWS can execute on non-main branches.
Split deployment permissions across dedicated IAM roles per environment, granting least privilege and separate trust conditions to reduce blast radius.