CVE-2026-5059: aws-mcp-server AWS CLI Command Injection
CVE-2026-5059 is a critical OS command injection flaw (CWE-78) in aws-mcp-server, disclosed through the Zero Day Initiative. According to the record, a remote attacker without authentication could execute code in the context of the MCP server. The CNA published a CVSS 3.0 base score of 9.8, but the record lists no affected versions, fixes, or confirmed exploitation.
Overview
CVE-2026-5059 affects aws-mcp-server, a server component that handles AWS CLI commands on behalf of MCP clients. The record describes an OS command injection weakness (CWE-78) in how the server handles its allowed commands list. A user-supplied string is used in a system call without adequate validation.
The vulnerability was reported through the Zero Day Initiative advisory and is tracked as ZDI-CAN-27969 in the record.
Impact
According to the record, a remote attacker can execute arbitrary code in the context of the MCP server, and no authentication is required. The CNA scored the issue with CVSS 3.0 at 9.8, with high confidentiality, integrity and availability impact and no user interaction required.
- The actual impact depends on the privileges and network exposure of the MCP server process in each deployment.
- Credentials available to the server, such as AWS configuration, may be exposed if code runs in its context. This is an inference, not a confirmed finding.
Affected products and versions
The record does not list any affected product versions or ranges. The product name aws-mcp-server is taken from the description. Consult the NVD entry and the ZDI advisory for vendor-confirmed version information.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.02319 with a percentile of 0.83014, which is an estimate of exploitation likelihood and not evidence of exploitation.
Remediation and mitigation
- Check the vendor or project channels for a fixed release of aws-mcp-server, since the record does not provide one.
- Until a fix is verified, restrict network access to the MCP server to trusted clients only and avoid exposing it to untrusted networks.
- Run the server with the least privilege needed, and limit the cloud credentials available to it.
- Review the allowed commands configuration and disable any functionality that is not required.
Detection guidance
- Review server logs for unexpected commands or arguments passed to AWS CLI operations, especially requests from unknown sources.
- Monitor the MCP server host for child processes spawned by the server that do not match normal operations.
- Alert on unusual outbound connections or cloud API activity originating from the server's credentials.
Limitations of the available information
The record has no title from the CNA, no affected version list, no fixed version, and no vendor advisory beyond the ZDI reference. The CVSS score comes from the CNA and no separate NVD assessment is shown. Details of the specific vulnerable code path are not in the record, so the analysis above is limited to the reported class and impact.
Frequently asked questions
What is CVE-2026-5059?
It is a critical OS command injection vulnerability (CWE-78) in aws-mcp-server, reported through the Zero Day Initiative. The record says an unauthenticated remote attacker could execute code in the MCP server context.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does not confirm active exploitation.
Which versions are affected and is there a fix?
The record does not list affected versions or fixed versions. Check the vendor or project channels and the ZDI advisory for version details and any released fix.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.