EUVD-2026-48299
GHSA-29w2-fq35-v728
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and UI:R because exploitation depends on the operator running a locally managed server in a specific startup failure state; AC:H because the non-default init-failure condition must occur; PR:N since the bypass needs no MCP-layer privilege, though IAM still bounds impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
5DescriptionCVE.org
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected.
To remediate this issue, users should upgrade to version 1.3.47.
AnalysisAI
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today