Code Execution Vulnerability in AWS MCP Server
CVE-2026-115845

5.3MEDIUM

Key Information:

Vendor

Aws

Status
Aws Mcp Server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115845?

The Python code validator in the AWS MCP Server's run_script tool has a vulnerability due to an incomplete list of disallowed inputs. This gap could potentially allow an authenticated remote user to run arbitrary code within their isolated session environment by utilizing a specially crafted script. AWS has addressed this issue on the service-side, and no action is needed from customers.

Affected Version(s)

AWS MCP Server

References

https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.