{"id":"CVE-2026-115413","kind":"vulnerability","aliases":["CVE-2026-115413"],"related":[],"title":"Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might…","description":"CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass\n\n### CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass\n\nBulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT\n\nDescription:\n\nThe AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and <1.6.0, the server validates a token's signature, issuer and expiry, but not the claim identifying the application the token was issued for. A token that the nominated identity provider issued to another application in the same tenant is therefore accepted, which may allow AWS API calls to be made with the credentials configured on the host.\n\nImpacted versions: >=1.3.0 AND <1.6.0\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-api-mcp-server version 1.6.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito.\n\nWorkarounds:\n\nOperators who cannot upgrade immediately can use the default stdio transport rather than the streamable-http transport.\n\nReferences:\n\n- CVE-2026-115413\n- GHSA-4prq-p2x5-w9fh\n\nAcknowledgement:\n\nWe would like to thank Yuval Elbar (@YuvalElbar6) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS API MCP Server in streamable-http mode with OAuth does not check the audience claim of bearer tokens, so a token issued by the same identity provider to a different application in the same tenant is accepted. An attacker holding such a token can make AWS API calls using the credentials configured on the host.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","aws","lab-disclosure","mcp","python","self-hosted"],"not_affected_if":["auth-not-oauth","stdio-transport","versions-outside-1.3.0-to-1.6.0"],"how_to_check":"- Run `pip show awslabs.aws-api-mcp-server` or check the installed package version; affected versions are >=1.3.0 and <1.6.0\n- Check whether `AUTH_TYPE` is set to `oauth` and whether the server runs with the streamable-http transport\n- Check whether `AUTH_AUDIENCE` or `AUTH_CLIENT_ID` is set","fix":"- Upgrade awslabs.aws-api-mcp-server to `1.6.0` or later\n- With `AUTH_TYPE=oauth`, set `AUTH_AUDIENCE`, or `AUTH_CLIENT_ID` for identity providers such as Amazon Cognito whose access tokens carry no audience claim\n- Until upgraded, use the default stdio transport instead of streamable-http\n- Patch any forked or derivative code with the new fixes","status":"open","published_at":"2026-10-27T00:00:00+00:00","first_seen_at":"2026-10-27T18:39:55+00:00","triaged_at":"2026-10-27T18:40:47+00:00","updated_at":"2026-10-27T19:33:18+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T18:40:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade awslabs.aws-api-mcp-server to `1.6.0` or later\n- With `AUTH_TYPE=oauth`, set `AUTH_AUDIENCE`, or `AUTH_CLIENT_ID` for identity providers such as Amazon Cognito whose access tokens carry no audience claim\n- Until upgraded, use the default stdio transport instead of streamable-http\n- Patch any forked or derivative code with the new fixes","reach":"network","title":"AWS API MCP Server: OAuth tokens from other apps accepted, enabling AWS calls","impact":"high","summary":"The AWS API MCP Server in streamable-http mode with OAuth does not check the audience claim of bearer tokens, so a token issued by the same identity provider to a different application in the same tenant is accepted. An attacker holding such a token can make AWS API calls using the credentials configured on the host.","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","python","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker makes AWS API calls using host-configured credentials","analyst_note":"Confirm exploitation details and any CVSS score at GHSA-4prq-p2x5-w9fh or the AWS bulletin 2026-152-AWS; sources give no severity.","how_to_check":"- Run `pip show awslabs.aws-api-mcp-server` or check the installed package version; affected versions are >=1.3.0 and <1.6.0\n- Check whether `AUTH_TYPE` is set to `oauth` and whether the server runs with the streamable-http transport\n- Check whether `AUTH_AUDIENCE` or `AUTH_CLIENT_ID` is set","needs_analyst":true,"not_affected_if":["stdio-transport","versions-outside-1.3.0-to-1.6.0","auth-not-oauth"],"who_is_affected":"Exposed deployments run the AWS API MCP Server with the streamable-http transport and OAuth authentication, where the host holds AWS credentials and the identity provider issues tokens to more than one application in the same tenant. Local stdio use is not in the described attack path. Teams on stdio or on versions outside >=1.3.0 and <1.6.0 can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000813,"input_tokens":3954,"output_tokens":835,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115413':21A,24A,100C,112C,201C,353C '-152':125C '-2026':20A,23A,99C,111C,200C,352C '00':138C '1.3.0':204C,265C '1.6.0':17A,206C,267C,281C '10/27/2026':136C '11':137C '2026':124C '4prq':356C 'accept':79B,246C 'access':321C 'acknowledg':359C 'address':273C 'agent':27B 'ai':26B,29B,158C 'ai-ag':25B 'ai-tool':28B 'allow':249C 'also':309C 'amazon':329C 'anoth':238C 'api':12A,42B,89B,102C,114C,144C,251C,277C 'api-mcp-serv':276C 'applic':73B,223C,239C 'assist':159C 'attack':81B 'attent':133C 'audienc':3A,56B,107C,119C,312C,325C 'auth':305C,311C,314C 'authent':8A,184C 'aw':11A,31B,41B,88B,101C,113C,126C,128C,143C,163C,168C,250C 'aws-security@amazon.com':381C 'awslabs.aws':275C 'bearer':59B,187C 'bulletin':122C 'bypass':109C,121C 'call':90B,252C 'cannot':334C 'carri':323C 'check':54B 'claim':57B,220C,326C 'cli':169C 'client':315C 'code':295C 'cognito':330C 'collabor':369C 'command':170C 'concern':387C 'configur':94B,174C,259C 'content':129C 'context':152C 'coordin':375C 'credenti':93B,258C 'cve':19A,22A,98C,110C,199C,351C 'date':135C 'default':340C 'deriv':294C 'descript':141C 'differ':72B 'disclosur':34B,377C 'elbar':366C 'email':380C 'enabl':157C 'ensur':290C 'expiri':216C 'fix':302C 'fork':292C 'ghsa':355C 'ghsa-4prq-p2x5-w9fh':354C 'hold':82B 'host':39B,97B,262C 'http':48B,180C,348C 'id':123C,316C 'ident':68B,191C,234C,318C 'identifi':198C,221C 'immedi':336C 'impact':263C 'import':131C 'incorpor':299C 'interact':161C 'issu':64B,227C,236C,270C,372C 'issuer':214C 'lab':33B 'lab-disclosur':32B 'latest':287C 'like':362C 'made':255C 'make':87B 'may':248C 'mcp':13A,35B,43B,103C,115C,145C,154C,278C 'might':18A 'miss':1A 'mode':9A,49B 'model':151C 'new':301C 'nomin':193C,233C 'oauth':7A,51B,105C,117C,183C,307C 'open':149C 'oper':196C,303C,332C 'p2x5':357C 'patch':297C 'pdt':140C 'pleas':379C 'process':378C 'protocol':153C 'provid':69B,192C,235C,319C 'public':134C 'python':36B 'question':385C 'rather':343C 'recommend':283C 'refer':350C 'requir':132C 'resolut':268C 'resourc':166C 'scope':127C 'secur':384C 'self':38B 'self-host':37B 'serv':176C 'server':14A,44B,104C,116C,146C,155C,208C,279C 'servic':164C 'set':310C 'signatur':213C 'sourc':150C 'stdio':341C 'streamabl':47B,179C,347C 'streamable-http':46B,178C,346C 'tenant':77B,243C 'thank':364C 'therefor':245C 'token':2A,60B,63B,85B,106C,118C,188C,211C,225C,230C,322C 'tool':30B 'transport':181C,342C,349C 'type':130C,306C 'upgrad':284C,335C 'use':91B,304C,338C 'valid':4A,108C,120C,185C,209C 'version':16A,203C,264C,280C,288C 'vulner':376C 'w9fh':358C 'whose':320C 'workaround':331C 'would':361C 'yuval':365C 'yuvalelbar6':367C","nicknames":[],"mitigations":[],"who_affected":"Exposed deployments run the AWS API MCP Server with the streamable-http transport and OAuth authentication, where the host holds AWS credentials and the identity provider issues tokens to more than one application in the same tenant. Local stdio use is not in the described attack path. Teams on stdio or on versions outside >=1.3.0 and <1.6.0 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-152-aws/#CVE-2026-115413","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-152-aws/","severity":null,"published_at":"2026-10-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-27T18:39:55+00:00","fetched_at":"2026-10-27T18:39:55+00:00","note":"AWS: CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass"},{"source":"nvd","external_id":"CVE-2026-115413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115413","severity":null,"published_at":"2026-10-27T19:17:10+00:00","modified_at":"2026-10-27T19:17:10+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[{"id":7391,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-152-aws/","title":"AWS: CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass","kind":"advisory","source":"lab","text":"CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass\n\n### CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass\n\nBulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT\n\nDescription:\n\nThe AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and <1.6.0, the server validates a token's signature, issuer and expiry, but not the claim identifying the application the token was issued for. A token that the nominated identity provider issued to another application in the same tenant is therefore accepted, which may allow AWS API calls to be made with the credentials configured on the host.\n\nImpacted versions: >=1.3.0 AND <1.6.0\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-api-mcp-server version 1.6.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito.\n\nWorkarounds:\n\nOperators who cannot upgrade immediately can use the default stdio transport rather than the streamable-http transport.\n\nReferences:\n\n- CVE-2026-115413\n- GHSA-4prq-p2x5-w9fh\n\nAcknowledgement:\n\nWe would like to thank Yuval Elbar (@YuvalElbar6) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-27T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}