EUVD-2026-48299
GHSA-29w2-fq35-v728
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
Earlier versions of this analysis (1)
Security policy bypass in awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor execute AWS API operations that the operator's configured policy was meant to deny or gate. The flaw is a fail-open condition: if the policy-enforcement data fails to initialize at server startup, the policy check is silently skipped for the entire lifetime of the process rather than failing closed. No public exploit identified at time of analysis and the issue is not in CISA KEV; the reporting vendor (AMZN) released a fix in 1.3.47.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when AWS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:L and UI:R because exploitation depends on the operator running a locally managed server in a specific startup failure state; AC:H because the non-default init-failure condition must occur; PR:N since the bypass needs no MCP-layer privilege, though IAM still bounds impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
3DescriptionCVE.org
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected.
To remediate this issue, users should upgrade to version 1.3.47.
Executive ViewAI
The AWS API MCP Server (versions 0.2.13-1.3.46) contains a policy-enforcement bypass that silently disables all access controls if configuration initialization fails at startup, potentially exposing unauthorized AWS operations to users of this server. Organizations using it to enforce fine-grained access controls are affected. The underlying AWS IAM permissions provide a secondary defense, but the intended primary control layer is completely circumvented.
Within 24 hours, inventory all systems running AWS API MCP Server and identify which versions are deployed (vulnerable versions are 0.2.13-1.3.46). Within 7 days, apply the vendor patch; confirm specific patched version availability from awslabs releases. Within 30 days, conduct post-patch verification: review policy-enforcement logs for initialization errors during startup and audit CloudTrail or equivalent logs for any anomalous API calls during the period the server was running an unpatched version.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Loom for AWS deployments running a version before 1.6.1 with no identity provider configured expose an unauthenticated s
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Broken access control in the VitaFit cloud API before the 2026-10-30 fix lets any authenticated account holder call POST
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attacke
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
Exploit-DB