AWS SAM CLI 1.166.2 Fixes Terraform Hook Command Injection
Tech GuruQuick Answer
AWS bulletin 2026-145-AWS fixes CVE-2026-115414 in SAM CLI 1.63.0 through 1.166.1. Upgrade to 1.166.2 or later, review Terraform inputs and derivative code, validate build pipelines, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory SAM CLI versions, Terraform-hook use, CI runners, shared modules, plan-file sources, forks, credentials, and owners. Confirm whether a vulnerable CLI consumed configuration or plan files outside the trusted build boundary; do not infer exposure from SAM CLI presence alone. Upgrade to SAM CLI 1.166.2 or later and incorporate the fix into maintained forks; until then, accept Terraform inputs only from trusted sources. Confirm the active CLI on every runner, rebuild representative projects, inspect anomalous build-host activity where untrusted input was possible, and retain package and pipeline evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS Serverless Application Model CLI Terraform hook |
|---|---|
| Advisory | 2026-145-AWS |
| CVE | CVE-2026-115414 |
| Authoritative release date | 2026-10-22 18:50:58 UTC |
| Authority revision date | 2026-10-22 18:50:58 UTC |
| Affected versions | AWS SAM CLI 1.63.0 through 1.166.1 when sam build --hook-name terraform consumes attacker-controlled Terraform configuration or plan files. |
| Fixed version | AWS SAM CLI 1.166.2 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS fixed OS command injection in the SAM CLI Terraform hook. A crafted Terraform configuration or plan can cause command execution as the user running the build.
What To Validate Now
- Inventory. Inventory SAM CLI versions, Terraform-hook use, CI runners, shared modules, plan-file sources, forks, credentials, and owners.
- Establish applicability. Confirm whether a vulnerable CLI consumed configuration or plan files outside the trusted build boundary; do not infer exposure from SAM CLI presence alone.
- Remediate. Upgrade to SAM CLI 1.166.2 or later and incorporate the fix into maintained forks; until then, accept Terraform inputs only from trusted sources.
- Validate. Confirm the active CLI on every runner, rebuild representative projects, inspect anomalous build-host activity where untrusted input was possible, and retain package and pipeline evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The command runs with the build user's privileges. Treat shared runners and stored cloud credentials as separate exposure questions, and do not regard input allowlisting as the complete remediation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
