CVE-2026-125271 AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls t...

CVE-2026-125271

The awslabs aws-api-mcp-server (versions before 1.5.1 ) is vulnerable to a security policy bypass due to incorrect normalization of operation names within the custom security policy enforcement. An actor may execute AWS API operations across services that were configured to be denied or required ...