{"id":"CVE-2026-115845","kind":"vulnerability","aliases":["CVE-2026-115845"],"related":[],"title":"AWS MCP Server: incomplete Python sandbox validation in run_script tool","description":"CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server\n\n### CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server\n\nBulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT\n\nDescription:\n\nAWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment.\n\nWe identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.\n\nImpacted versions: N/A (managed service, exclusively hosted)\n\nResolution:\n\nThis issue has been addressed service-side. No customer action is required.\n\nWorkarounds:\n\nThe run_script tool is designed to orchestrate AWS APIs through a Python script. If you use it only to run a Python script that makes AWS API calls, no workaround is required.\n\nReferences:\n\n- CVE-2026-115845\n\nAcknowledgement:\n\nWe would like to thank Manash Saikiafor collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The Python code validator of the run_script tool in AWS MCP Server uses an incomplete list of disallowed inputs. An authenticated user can send a crafted script to execute arbitrary code inside their own isolated session.","severity":"medium","cvss":6.4,"epss":0.0038,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","aws","lab-disclosure","mcp"],"not_affected_if":["managed-hosting","no-aws-mcp-server"],"how_to_check":null,"fix":"- No customer action required; AWS has fixed the issue service-side in the managed AWS MCP Server.","status":"open","published_at":"2026-10-23T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:59:12+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:59:12Z","model":"claude-haiku-5-5","output":{"fix":"- No customer action required; AWS has fixed the issue service-side in the managed AWS MCP Server.","reach":"internet","title":"AWS MCP Server: incomplete Python sandbox validation in run_script tool","impact":"medium","summary":"The Python code validator of the run_script tool in AWS MCP Server uses an incomplete list of disallowed inputs. An authenticated user can send a crafted script to execute arbitrary code inside their own isolated session.","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","ai-agents"],"confidence":0.7,"needs_auth":"yes","worst_case":"code runs inside the attacker's own isolated session","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["managed-hosting","no-aws-mcp-server"],"who_is_affected":"AWS MCP Server is a managed, AWS-hosted service with no customer-deployed versions, and AWS states the issue is addressed service-side. Teams that use run_script only to run Python scripts making AWS API calls need no workaround. The exposure is limited to the attacker's own sandboxed session, so teams with no AWS MCP Server use can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3811,"output_tokens":460,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115845':14A,17A,68C,83C,153C,254C '-149':99C '-2026':13A,16A,67C,82C,152C,253C '00':112C '10/23/2026':110C '12':111C '2026':98C 'access':127C 'acknowledg':255C 'action':214C 'address':208C 'agent':20B,126C 'ai':19B,22B,125C 'ai-ag':18B 'ai-tool':21B 'allow':177C 'api':227C,245C 'arbitrari':59B,184C 'attent':107C 'authent':50B,179C 'aw':1A,24B,39B,78C,93C,100C,102C,116C,129C,167C,226C,244C 'aws-security@amazon.com':275C 'bulletin':96C 'call':246C 'code':31B,60B,159C,185C 'collabor':263C 'concern':281C 'content':103C 'context':133C 'coordin':269C 'craft':55B,194C 'custom':213C 'cve':12A,15A,66C,81C,151C,252C 'date':109C 'descript':115C 'design':223C 'disallow':47B,174C 'disclosur':27B,271C 'email':274C 'environ':148C,191C 'exclus':201C 'execut':58B,183C 'give':124C 'host':202C 'id':97C 'identifi':150C 'impact':196C 'import':105C 'includ':136C 'incomplet':4A,44B,69C,84C,171C 'input':48B,175C 'insid':61B 'isol':64B,189C 'issu':155C,205C,266C 'lab':26B 'lab-disclosur':25B 'like':258C 'list':45B,172C 'make':243C 'manag':121C,199C 'manash':261C 'mcp':2A,28B,40B,79C,94C,117C,135C,168C 'might':176C 'model':132C 'n/a':198C 'orchestr':225C 'pdt':114C 'pleas':273C 'pm':113C 'process':272C 'protocol':134C 'public':108C 'python':5A,30B,75C,90C,143C,158C,230C,240C 'question':279C 'refer':251C 'remot':180C 'requir':106C,216C,250C 'resolut':203C 'run':9A,35B,73C,88C,138C,142C,163C,219C,238C 'saikiafor':262C 'sandbox':6A,76C,91C,147C 'scope':101C 'script':10A,36B,56B,74C,89C,139C,144C,164C,195C,220C,231C,241C 'secur':278C 'send':53B 'server':3A,41B,80C,95C,118C,122C,169C 'servic':200C,210C 'service-sid':209C 'session':65B,190C 'side':211C 'thank':260C 'tool':11A,23B,37B,140C,165C,221C 'type':104C 'use':42B,234C 'user':51B,181C 'valid':7A,32B,70C,85C,160C 'version':197C 'via':192C 'vulner':270C 'within':186C 'workaround':217C,248C 'would':257C","nicknames":[],"mitigations":[{"kind":"platform-fix","scope":"AWS MCP Server run_script tool, for all customers of the managed service","since":null,"covers":"The run_script Python code validator in the AWS MCP Server managed service, addressed service-side for all customers.","limits":"None stated.","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/","vendor":"AWS","seen_at":"2026-10-25T01:36:11Z","sources":["https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/"],"confidence":0.9,"source_title":"CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server","customer_action":"None required according to the bulletin."}],"who_affected":"AWS MCP Server is a managed, AWS-hosted service with no customer-deployed versions, and AWS states the issue is addressed service-side. Teams that use run_script only to run Python scripts making AWS API calls need no workaround. The exposure is limited to the attacker's own sandboxed session, so teams with no AWS MCP Server use can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115845","severity":null,"published_at":"2026-10-23T19:17:44+00:00","modified_at":"2026-10-23T19:23:01+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/#CVE-2026-115845","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/","severity":null,"published_at":"2026-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:43:42+00:00","fetched_at":"2026-10-25T01:37:02+00:00","note":"AWS: CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server"},{"source":"epss","external_id":"CVE-2026-115845","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115845","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2956,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/","title":"AWS: CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server","kind":"advisory","source":"lab","text":"CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server\n\n### CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server\n\nBulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT\n\nDescription:\n\nAWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment.\n\nWe identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.\n\nImpacted versions: N/A (managed service, exclusively hosted)\n\nResolution:\n\nThis issue has been addressed service-side. No customer action is required.\n\nWorkarounds:\n\nThe run_script tool is designed to orchestrate AWS APIs through a Python script. If you use it only to run a Python script that makes AWS API calls, no workaround is required.\n\nReferences:\n\n- CVE-2026-115845\n\nAcknowledgement:\n\nWe would like to thank Manash Saikiafor collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-23T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}