11 matches found
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
SummaryThe AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.1.8) potentially affected by CVE-2026-16584 via awslabs-aws-api-mcp-server (>=1.0.2, <=1.3.24)
awslabs-aws-api-mcp-server PYPI version =1.0.2, =2.0.4, =2.1.8 Source cves: CVE-2026-16584 Source advisory: OSV:PYSEC-2026-3549...
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
Summary The AWS API MCP Server is an open source Model Context Protocol MCP server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It provides programmatic access to manage your AWS infrastructure while maintaining proper security controls. It...
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.1.8) potentially affected by CVE-2026-16584 via awslabs-aws-api-mcp-server (>=1.0.2, <=1.3.24)
awslabs-aws-api-mcp-server PYPI version =1.0.2, =2.0.4, =2.1.8 Source cves: CVE-2026-16584 Source advisory: OSV:GHSA-29W2-FQ35-V728...
CVE-2026-16584: Non-exit on Failed Initialization
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.0.19) potentially affected by CVE-2026-4270 via awslabs-aws-api-mcp-server (1.0.2)
awslabs-aws-api-mcp-server PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on awslabs-aws-api-mcp-server and may be impacted: - awslabs-dynamodb-mcp-server =2.0.4, =2.0.19 Source cves: CVE-2026-4270 Source advisory: OSV:GHSA-2CPP-J2FC-Q...
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.0.19) potentially affected by CVE-2026-4270 via awslabs-aws-api-mcp-server (1.0.2)
awslabs-aws-api-mcp-server PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on awslabs-aws-api-mcp-server and may be impacted: - awslabs-dynamodb-mcp-server =2.0.4, =2.0.19 Source cves: CVE-2026-4270 Source advisory: GHSA-2CPP-J2FC-QHP7...
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.0.19) potentially affected by CVE-2026-4270 via awslabs-aws-api-mcp-server (1.0.2)
awslabs-aws-api-mcp-server PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on awslabs-aws-api-mcp-server and may be impacted: - awslabs-dynamodb-mcp-server =2.0.4, =2.0.19 Source cves: CVE-2026-4270 Source advisory: OSV:PYSEC-2026-162...
CVE-2026-4270
CVE-2026-4270 affects AWS API MCP Server (versions >= 0.2.14 and
awslabs-dynamodb-mcp-server (>=2.0.4, <=2.0.19) potentially affected by CVE-2026-4270 via awslabs-aws-api-mcp-server (1.0.2)
awslabs-aws-api-mcp-server PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on awslabs-aws-api-mcp-server and may be impacted: - awslabs-dynamodb-mcp-server =2.0.4, =2.0.19 Source cves: CVE-2026-4270 Source advisory: MEND:CVE-2026-4270...
CVE-2026-4270: Improper Protection of Alternate Path
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions = 0.2.14 and 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To...