AWS API MCP Server EUVD-2026-121327

Exploitation requires ALL of the following per the AWS advisory: a locally run aws-api-mcp-server instance (version >=0.2.13 and <1.5.1); a CUSTOM security policy that actually lists the affected operations in its denyList or elicitList; user interaction driving the AI assistant to invoke the operation; and the targeted AWS API operation name must contain consecutive capital letters (which defeats the incorrect normalization). Limiting factors that reduce realistic risk: the hosted/remote AWS API MCP Server offering is NOT affected, and deployments relying on the READ_OPERATIONS_ONLY or REQUIRE_MUTATION_CONSENT settings are NOT affected; default or non-custom policy configurations do not expose the bypass. There is no workaround other than upgrading to 1.5.1.

Signals are consistent but moderated by deployment preconditions. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H) scores 8.5 on severity, but the attack vector is LOCAL and requires user interaction (UI:P), so this is not a remotely-reachable mass-exploitation bug. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or at-scale exploitation - consistent with a flaw that was found and reported by the vendor (AMZN) through coordinated disclosure rather than observed in attacks. The vuln.today Decision label is 'this_week', indicating prompt but non-emergency remediation. Crucially, exploitability is gated on a non-default condition: the operator must run the server locally with a CUSTOM security policy that lists the affected operations in its denyList/elicitList, and the targeted operation name must contain consecutive capital letters; the remote AWS offering and the READ_OPERATIONS_ONLY / REQUIRE_MUTATION_CONSENT settings are explicitly NOT affected. Net: a real, high-impact policy-bypass worth patching on the vendor's 'this_week' timeline, but the local vector, required user interaction, and dependency on a specific custom-policy configuration bound its real-world risk well below the raw 8.5 severity.

An operator runs aws-api-mcp-server locally with a custom security policy that denies or requires elicitation for sensitive operations (e.g. DeactivateMFADevice, DeleteDBCluster, creating a federated identity provider). A user drives the AI assistant to request such an operation; because the operation name contains consecutive capital letters, the server normalizes it incorrectly and fails to match the policy entry, so the operation executes despite being configured as denied or gated. No public exploit was identified; exploitation is local and requires user interaction with the assistant.