CVE-2026-115845

AWS MCP Server script validation permits code inside an authenticated session

Amazon Web Services · AWS MCP Server managed run_script tool

First documented disclosure · Review checkpoint

Summary

Incomplete Python validation permits code within the caller’s own isolated session.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The validator’s disallowed-input list misses crafted script inputs.

Conditions required

An authenticated remote caller able to submit a crafted script.

Potential impact

Code execution within that caller’s isolated environment; cross-customer compromise is not established.

Affected versions and configurations

Exclusively hosted managed service; no customer-installable version range.

Fix and mitigation status

Fixed service-side by AWS.

Practical next steps

AWS states no customer action is required. Preserve normal least-privilege controls for agent access to AWS.

Operating lesson

Separate sandbox restrictions from tenant isolation when assessing impact.

Evidence and limits

AWS published its bulletin October 23 at 12:00 PDT; CNA publication followed minutes later. AWS also provides CVSS 3.1 6.4; displayed score is its CVSS 4.0 5.3. No victim incident is claimed.

Sources