p PatchFirst

PatchFirst · Latest vulnerabilities

awslabs-aws-api-mcp-server vulnerabilities

Vulnerabilities published for awslabs-aws-api-mcp-server in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-16584

    High · CVSS 7.3EPSS 0.23%Fix available

    AWS API MCP Server Security Policy Bypass via Startup Failure

    Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected. To remediate this issue, users should upgrade to version 1.3.47.

    awslabs-aws-api-mcp-serverPython
    • Update to 1.3.47
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-4270

    Medium · CVSS 6.8EPSS 0.13%Fix available

    AWS API MCP File Access Restriction Bypass

    Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

    awslabs-aws-api-mcp-serverPython
    • Update to 1.3.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →