Aws Api Mcp Server
Monthly
Incorrect normalization of operation names in the custom security policy enforcement of awslabs aws-api-mcp-server (versions 0.2.13 through 1.5.1) lets the server mis-compare AWS API operation names that contain consecutive capital letters against the operator's denyList and elicitList, so operations the policy was meant to block or gate behind elicitation can still be executed. Impact is confined to locally run instances that use a custom security policy explicitly listing the affected operations, and exploitation additionally requires a user to drive the AI assistant into invoking the operation; the hosted/remote AWS API MCP Server offering and deployments relying on READ_OPERATIONS_ONLY or REQUIRE_MUTATION_CONSENT are not affected. Severity is rated 8.5 (CVSS 4.0), no public exploit code has been identified at time of analysis, and AWS states the only remedy is upgrading to 1.5.1.
Missing OAuth token audience validation in AWS API MCP Server 1.3.0 through 1.5.x lets a local caller reach the server using a bearer token that the identity provider issued to a different application in the same tenant, and then run AWS operations with the AWS credentials configured on the host. The flaw is conditional: it only applies to deployments using the non-default streamable-http transport with OAuth authentication enabled against an operator-nominated identity provider, while the default stdio transport is unaffected. Resulting access is bounded by the permissions of the host's AWS credentials; no public exploit code has been identified at time of analysis, and version 1.6.0 fixes the issue and additionally requires operators to configure an expected token audience or client ID.
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
AWS API MCP Server versions 0.2.14 through 1.3.9 contain an improper path protection flaw in the no-access and workdir features that allows local attackers to bypass file access restrictions and read arbitrary files accessible to the MCP client application. An attacker with local access and user interaction can exploit this vulnerability to expose sensitive local file contents. Users should upgrade to version 1.3.9 or later to remediate this issue.
Incorrect normalization of operation names in the custom security policy enforcement of awslabs aws-api-mcp-server (versions 0.2.13 through 1.5.1) lets the server mis-compare AWS API operation names that contain consecutive capital letters against the operator's denyList and elicitList, so operations the policy was meant to block or gate behind elicitation can still be executed. Impact is confined to locally run instances that use a custom security policy explicitly listing the affected operations, and exploitation additionally requires a user to drive the AI assistant into invoking the operation; the hosted/remote AWS API MCP Server offering and deployments relying on READ_OPERATIONS_ONLY or REQUIRE_MUTATION_CONSENT are not affected. Severity is rated 8.5 (CVSS 4.0), no public exploit code has been identified at time of analysis, and AWS states the only remedy is upgrading to 1.5.1.
Missing OAuth token audience validation in AWS API MCP Server 1.3.0 through 1.5.x lets a local caller reach the server using a bearer token that the identity provider issued to a different application in the same tenant, and then run AWS operations with the AWS credentials configured on the host. The flaw is conditional: it only applies to deployments using the non-default streamable-http transport with OAuth authentication enabled against an operator-nominated identity provider, while the default stdio transport is unaffected. Resulting access is bounded by the permissions of the host's AWS credentials; no public exploit code has been identified at time of analysis, and version 1.6.0 fixes the issue and additionally requires operators to configure an expected token audience or client ID.
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API operations that the operator's configured policy was meant to deny or gate. If the policy-enforcement data fails to initialize at startup, the server continues running with all policy checks silently disabled for the entire life of the process, so deny/gate rules are never applied. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw's real-world impact is bounded because the IAM permissions on the configured credentials still apply.
AWS API MCP Server versions 0.2.14 through 1.3.9 contain an improper path protection flaw in the no-access and workdir features that allows local attackers to bypass file access restrictions and read arbitrary files accessible to the MCP client application. An attacker with local access and user interaction can exploit this vulnerability to expose sensitive local file contents. Users should upgrade to version 1.3.9 or later to remediate this issue.