Aws-mcp-server vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Aws-mcp-server products: 2 record(s), with severity, exploitation and fixes.

Aws-mcp-server 2

Exploited only (KEV) →

CVE-2026-5059 Critical · 9.8 CWE-78 Apr 10, 2026

aws-mcp-server AWS CLI Command Injection (CVE-2026-5059)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.

CVE-2026-5058 Critical · 9.8 CWE-78 Apr 10, 2026

aws-mcp-server Command Injection Remote Code Execution Vulnerability

aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27968.