Aws Api Mcp Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Aws Api Mcp Server.
By the Year
In 2026 there have been 3 vulnerabilities in Aws Api Mcp Server with an average score of 7.5 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 7.53 |
It may take a day or so for new Aws Api Mcp Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Aws Api Mcp Server Security Vulnerabilities
aws-api-mcp-server <1.5.1: Op name normalization bypasses security policy
CVE-2026-125271
7.8 - High
- November 10, 2026
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters. To remediate this issue, users should upgrade to version 1.5.1.
Comparison Using Wrong Factors
AWS API MCP Server <1.6.0 OAuth Token Audience Validation Bypass
CVE-2026-115413
7.8 - High
- October 27, 2026
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.
Origin Validation Error
AWS API MCP Server 0.2.13-1.3.46 Init Failure Bypass
CVE-2026-16584
7 - High
- July 23, 2026
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected. To remediate this issue, users should upgrade to version 1.3.47.
Non-exit on Failed Initialization
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Aws Api Mcp Server or by Aws? Click the Watch button to subscribe.
