aws-api-mcp-server <1.5.1: Op name normalization bypasses security policy
CVE-2026-125271 Published on November 10, 2026
AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters.
To remediate this issue, users should upgrade to version 1.5.1.
Vulnerability Analysis
CVE-2026-125271 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
Comparison Using Wrong Factors
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses. This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two "equal" objects to be considered unequal.
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-125271 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-125271
stack.watch emails you whenever new vulnerabilities are published in Aws Api Mcp Server or Amazon Aws. Just hit a watch button to start following.
