Live › vulnerability › CVE-2026-115845
Go to dashboardThe Python code validator of the run_script tool in AWS MCP Server uses an incomplete list of disallowed inputs. An authenticated user can send a crafted script to execute arbitrary code inside their own isolated session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
AWS MCP Server is a managed, AWS-hosted service with no customer-deployed versions, and AWS states the issue is addressed service-side. Teams that use run_script only to run Python scripts making AWS API calls need no workaround. The exposure is limited to the attacker's own sandboxed session, so teams with no AWS MCP Server use can skip it.
No product ranges from the sources yet.
Unknown from the sources.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT
Description:
AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment.
We identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
Impacted versions: N/A (managed service, exclusively hosted)
Resolution:
This issue has been addressed service-side. No customer action is required.
Workarounds:
The run_script tool is designed to orchestrate AWS APIs through a Python script. If you use it only to run a Python script that makes AWS API calls, no workaround is required.
References:
Acknowledgement:
We would like to thank Manash Saikiafor collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-115845")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.