[ CVE-2026-115845 · Published 23 Oct 2026 ]
Vulnerability in AWS MCP Server
CVSS 6.4
EPSS <1%No fix listed yet
[ Description ]Official description
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.