Improper Security Policy Enforcement in AWS API MCP Server by AWS Labs
CVE-2026-125271

8.5HIGH

Key Information:

Vendor

Aws

Status
Aws-api-mcp-server
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125271?

A flaw in AWS Labs' aws-api-mcp-server prior to version 1.5.1 allows for improper normalization of operation names, leading to the potential for attackers to execute API operations that should be restricted by the user's security policy. This issue arises when operation names contain consecutive capital letters, potentially bypassing policy restrictions. Users are strongly advised to upgrade to version 1.5.1 to mitigate this risk.

Affected Version(s)

aws-api-mcp-server 0.2.13 < 1.5.1

References

https://pypi.org/project/awslabs.aws-api-mcp-server/1.5.1/
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/awslabs/mcp/security/advisories/GHSA-4...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.