CVE-2026-115413

AWS API MCP Server accepts OAuth tokens issued for another application

AWS · AWS API MCP Server

First documented disclosure · Review checkpoint

Summary

A missing audience check can let a caller use another application’s token to invoke AWS operations.

Severity and exploitation evidence

High · 7.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

OAuth validation checks signature, issuer and expiry but omits the intended application.

Conditions required

Streamable HTTP with OAuth; a local caller holds a valid token from another application in the configured identity provider’s same tenant.

Potential impact

AWS operations within the permissions of the credentials configured on the server host.

Affected versions and configurations

awslabs.aws-api-mcp-server >=1.3.0, <1.6.0.

Fix and mitigation status

1.6.0, with the expected token audience or client ID configured.

Practical next steps

Upgrade and set AUTH_AUDIENCE, or AUTH_CLIENT_ID for providers whose tokens lack an audience claim. Until then, use the default stdio transport.

Operating lesson

Validate a token’s intended resource as well as its signature.

Evidence and limits

AWS and the CNA disclosed this on October 27. Preserve the CNA’s local attack vector and deployment prerequisites; this is not a universal unauthenticated AWS takeover.

Sources