AWS MCP Server CVE-2026-115845

Requires an authenticated session on the AWS MCP Server (PR:L) and the ability to invoke the run_script tool and submit a crafted Python script that evades the tool's incomplete disallowed-input validator. Resulting code execution is strictly confined to the attacker's own isolated session environment, so there is no stated cross-session, cross-tenant, or host-level impact. Limiting factors: valid authentication is required (not anonymous/unauthenticated), the impact is self-contained to the user's own sandbox, and AWS has already remediated the flaw service-side so unpatched exposure is not under customer control.

This is a medium-severity issue (CVSS 4.0 base 5.3) whose real-world priority is low despite the 'RCE' tag. The decisive mitigating factor is in the description itself: the arbitrary code executes only 'within their own isolated session environment,' meaning an authenticated user gains code execution in a sandbox they already control rather than breaking out to other tenants, sessions, or AWS infrastructure. The CVSS 4.0 vector is internally consistent with this low impact - AV:N/AC:L/PR:L/UI:N with only Low vulnerable-system impacts (VC:L/VI:L/VA:N) and Low subsequent-system impacts (SC:L/SI:L) - i.e. network-reachable and easy to trigger, but requiring authentication (PR:L) and yielding limited consequence. No EPSS score, no CISA KEV listing, and no exploit/PoC reference are present in the input, so there is no public exploitation signal; CWE-184 (incomplete list of disallowed inputs) matches the 'incomplete list of disallowed inputs in the Python code validator' root cause. Crucially, AWS states it fixed the issue service-side with no customer action required, which further lowers operational urgency. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a contained, vendor-remediated weakness. Net: a genuine validator-bypass bug, but closer to a high-CVSS-label/low-real-risk item than a priority emergency, because impact is confined to the attacker's own sandbox and the vendor has already remediated it.

An authenticated user of the AWS MCP Server crafts a Python script that evades the run_script tool's disallowed-input validator because the blocklist is incomplete (CWE-184), and runs code that the validator was intended to prevent. Because the code executes only inside the user's own isolated session, the realistic outcome is the user escaping the intended scripting restrictions within their own sandbox rather than compromising other users or AWS systems. No public exploit or PoC reference is provided in the input.