Bulletin ID: 2026-063-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/23/2026 08:30 AM PDT

Description:

The AWS API MCP Server (awslabs.aws-api-mcp-server) is an open-source MCP server that lets AI assistants execute AWS CLI commands against a user's AWS account. It includes an optional, user-configured security policy that can deny or gate specific AWS operations. We identified CVE-2026-16584. On startup, the server loads the data used to enforce this security policy. If that initialization fails, the server continues running with the per-request policy check skipped for the lifetime of the process. When a security policy is configured without the fail-closed modes enabled, an actor could then cause AWS API operations that the policy was configured to deny or gate to execute without enforcement. IAM permissions on the configured credentials remain in effect and are unaffected.

Impacted versions: >= 0.2.13 AND < 1.3.47

Resolution:

This issue has been addressed in awslabs.aws-api-mcp-server version 1.3.47. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Until you can upgrade, any one of the following prevents the bypass:

• Use least-privilege IAM credentials (for example, a ReadOnlyAccess role) scoped to the task. IAM remains the primary access control and is enforced regardless of this issue.
• If the server started while connectivity was degraded, restart it once connectivity is restored so the policy enforcement data loads successfully.

References:

• CVE-2026-16584
• GHSA-29w2-fq35-v728

Acknowledgement:

We would like to thank Lav Kumar Vishwakarma (independent security researcher) on this issue through the coordinated vulnerability disclosure process.
 

Please email aws-security@amazon.com with any security questions or concerns.