{"id":"CVE-2026-125271","kind":"vulnerability","aliases":["CVE-2026-125271"],"related":[],"title":"Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server…","description":"CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization\n\n### CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization\n\nBulletin ID: 2026-176-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 08:30 AM PST\n\n Description:\n\nAWS API MCP Server is an open source Model Context Protocol (MCP) server that customers run to let AI assistants manage their AWS accounts through AWS API calls.\n\nWe identified CVE-2026-125271, an issue in the custom security policy enforcement of AWS API MCP Server versions between 0.2.13 and 1.5.0. The server normalized operation names incorrectly before comparing them to the operator's security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for.\n\nImpacted versions: >= 0.2.13 AND < 1.5.1\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-api-mcp-server version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading.\n\nReferences:\n\n- CVE-2026-125271\n- GHSA-4wq9-grf3-qg2p\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"AWS API MCP Server normalizes operation names incorrectly, so names with consecutive capital letters never match a correctly written denyList or elicitList entry. An attacker can run AWS API operations the operator's security policy was meant to block or require confirmation for.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","aws-api-mcp-server","lab-disclosure","mcp","self-hosted"],"not_affected_if":["no-custom-security-policy","version-1.5.1-or-later"],"how_to_check":"- Find the installed version of awslabs.aws-api-mcp-server and check whether it is `>= 0.2.13` and `< 1.5.1`.\n- Check whether the server enforces a custom security policy with a denyList or elicitList.","fix":"- awslabs.aws-api-mcp-server: upgrade to `1.5.1`, and patch any forked or derivative code.","status":"open","published_at":"2026-11-10T17:17:28+00:00","first_seen_at":"2026-11-10T17:00:47+00:00","triaged_at":"2026-11-10T17:02:37+00:00","updated_at":"2026-11-10T17:22:41+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T17:02:37Z","model":"claude-haiku-5-5","output":{"fix":"- awslabs.aws-api-mcp-server: upgrade to `1.5.1`, and patch any forked or derivative code.","reach":"unknown","title":"AWS API MCP Server: operation-name bypass lets denied AWS calls run","impact":"high","summary":"AWS API MCP Server normalizes operation names incorrectly, so names with consecutive capital letters never match a correctly written denyList or elicitList entry. An attacker can run AWS API operations the operator's security policy was meant to block or require confirmation for.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","aws-api-mcp-server","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"AWS operations the security policy should block run anyway","analyst_note":"","how_to_check":"- Find the installed version of awslabs.aws-api-mcp-server and check whether it is `>= 0.2.13` and `< 1.5.1`.\n- Check whether the server enforces a custom security policy with a denyList or elicitList.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.5.1-or-later","no-custom-security-policy"],"who_is_affected":"Teams that run AWS API MCP Server versions from 0.2.13 up to but not including 1.5.1 and rely on its denyList or elicitList policy to restrict AWS operations. Forks or derivative code carry the same flaw until they are patched. Servers on 1.5.1 or later, or servers without a custom security policy, are not affected by this bypass.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000826,"input_tokens":5185,"output_tokens":614,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125271':21A,24A,85C,100C,165C,291C '-176':116C '-2026':20A,23A,84C,99C,164C,290C '0.2.13':181C,242C '08':128C '1.5.0':183C '1.5.1':244C,258C '11/10/2026':127C '2026':115C '30':129C '4wq9':294C 'account':156C 'acknowledg':297C 'actor':220C 'address':250C 'ai':26B,151C 'ai-tool':25B 'allow':218C 'ana':304C 'api':16A,31B,42B,69B,87C,102C,134C,159C,176C,224C,254C 'api-mcp-serv':253C 'assist':152C 'attack':65B 'attent':124C 'aw':15A,28B,30B,41B,68B,86C,101C,117C,119C,133C,155C,158C,175C,223C 'aws-api-mcp-serv':14A,29B 'aws-security@amazon.com':319C 'awslab':13A 'awslabs.aws':252C 'block':79B 'bulletin':113C 'bypass':92C,107C 'call':160C 'capit':53B,205C 'code':272C 'collabor':307C 'compar':191C 'concern':326C 'configur':233C 'confirm':82B 'consecut':52B,204C 'contain':203C 'content':120C 'context':142C 'coordin':313C 'correct':58B,210C 'custom':8A,147C,170C 'cve':19A,22A,83C,98C,163C,289C 'date':126C 'deni':235C 'denylist':60B,212C 'deriv':271C 'descript':132C 'disclosur':36B,315C 'ecur':323C 'elicit':238C 'elicitlist':62B,214C 'email':318C 'enforc':11A,173C 'ensur':267C 'entri':63B,215C 'execut':222C 'fix':279C 'fork':269C 'ghsa':293C 'ghsa-4wq9-grf3-qg2p':292C 'grf3':295C 'host':40B 'id':114C 'identifi':162C 'impact':240C 'import':122C 'incorpor':276C 'incorrect':1A,48B,94C,109C,189C 'issu':167C,247C,310C 'lab':35B 'lab-disclosur':34B 'latest':264C 'let':150C 'letter':54B,206C 'like':300C 'manag':153C 'match':56B,208C 'mcp':17A,32B,37B,43B,88C,103C,135C,144C,177C,255C 'meant':77B 'might':217C 'model':141C 'mohiuddin':305C 'name':5A,47B,50B,96C,111C,188C,202C 'never':55B,207C 'new':278C 'normal':2A,45B,97C,112C,186C 'open':139C 'oper':4A,46B,70B,72B,95C,110C,187C,195C,200C,225C,228C 'patch':274C 'pleas':317C 'polici':10A,75B,91C,106C,172C,198C,231C 'process':316C 'protocol':143C 'pst':131C 'public':125C 'qg2p':296C 'question':324C 'recommend':260C 'refer':288C 'requir':81B,123C,237C 'resolut':245C 'run':67B,148C 'scope':118C 'secur':9A,74B,90C,105C,171C,197C,230C 'self':39B 'self-host':38B 'server':18A,33B,44B,89C,104C,136C,145C,178C,185C,256C 'sourc':140C 'sy':303C 'thank':302C 'tool':27B 'type':121C 'upgrad':261C,287C 'version':179C,241C,257C,265C 'via':93C,108C 'vulner':314C 'whose':201C 'workaround':280C,284C 'would':299C 'written':59B,211C","nicknames":[],"mitigations":[],"who_affected":"Teams that run AWS API MCP Server versions from 0.2.13 up to but not including 1.5.1 and rely on its denyList or elicitList policy to restrict AWS operations. Forks or derivative code carry the same flaw until they are patched. Servers on 1.5.1 or later, or servers without a custom security policy, are not affected by this bypass.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","awsapimcpserver","high","labdisclosure","mcp","selfhosted"],"campaign_type":null,"search_a":"'-125271':21A,24A '-2026':20A,23A 'api':16A 'aw':15A 'aws-api-mcp-serv':14A 'awslab':13A 'custom':8A 'cve':19A,22A 'enforc':11A 'incorrect':1A 'mcp':17A 'name':5A 'normal':2A 'oper':4A 'polici':10A 'secur':9A 'server':18A","search_b":"'ai':26B 'ai-tool':25B 'api':31B,42B,69B 'attack':65B 'aw':28B,30B,41B,68B 'aws-api-mcp-serv':29B 'block':79B 'capit':53B 'confirm':82B 'consecut':52B 'correct':58B 'denylist':60B 'disclosur':36B 'elicitlist':62B 'entri':63B 'host':40B 'incorrect':48B 'lab':35B 'lab-disclosur':34B 'letter':54B 'match':56B 'mcp':32B,37B,43B 'meant':77B 'name':47B,50B 'never':55B 'normal':45B 'oper':46B,70B,72B 'polici':75B 'requir':81B 'run':67B 'secur':74B 'self':39B 'self-host':38B 'server':33B,44B 'tool':27B 'written':59B","search_c":"'-125271':85C,100C,165C,291C '-176':116C '-2026':84C,99C,164C,290C '0.2.13':181C,242C '08':128C '1.5.0':183C '1.5.1':244C,258C '11/10/2026':127C '2026':115C '30':129C '4wq9':294C 'account':156C 'acknowledg':297C 'actor':220C 'address':250C 'ai':151C 'allow':218C 'ana':304C 'api':87C,102C,134C,159C,176C,224C,254C 'api-mcp-serv':253C 'assist':152C 'attent':124C 'aw':86C,101C,117C,119C,133C,155C,158C,175C,223C 'aws-security@amazon.com':319C 'awslabs.aws':252C 'bulletin':113C 'bypass':92C,107C 'call':160C 'capit':205C 'code':272C 'collabor':307C 'compar':191C 'concern':326C 'configur':233C 'consecut':204C 'contain':203C 'content':120C 'context':142C 'coordin':313C 'correct':210C 'custom':147C,170C 'cve':83C,98C,163C,289C 'date':126C 'deni':235C 'denylist':212C 'deriv':271C 'descript':132C 'disclosur':315C 'ecur':323C 'elicit':238C 'elicitlist':214C 'email':318C 'enforc':173C 'ensur':267C 'entri':215C 'execut':222C 'fix':279C 'fork':269C 'ghsa':293C 'ghsa-4wq9-grf3-qg2p':292C 'grf3':295C 'id':114C 'identifi':162C 'impact':240C 'import':122C 'incorpor':276C 'incorrect':94C,109C,189C 'issu':167C,247C,310C 'latest':264C 'let':150C 'letter':206C 'like':300C 'manag':153C 'match':208C 'mcp':88C,103C,135C,144C,177C,255C 'might':217C 'model':141C 'mohiuddin':305C 'name':96C,111C,188C,202C 'never':207C 'new':278C 'normal':97C,112C,186C 'open':139C 'oper':95C,110C,187C,195C,200C,225C,228C 'patch':274C 'pleas':317C 'polici':91C,106C,172C,198C,231C 'process':316C 'protocol':143C 'pst':131C 'public':125C 'qg2p':296C 'question':324C 'recommend':260C 'refer':288C 'requir':123C,237C 'resolut':245C 'run':148C 'scope':118C 'secur':90C,105C,171C,197C,230C 'server':89C,104C,136C,145C,178C,185C,256C 'sourc':140C 'sy':303C 'thank':302C 'type':121C 'upgrad':261C,287C 'version':179C,241C,257C,265C 'via':93C,108C 'vulner':314C 'whose':201C 'workaround':280C,284C 'would':299C 'written':211C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:34:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-176-aws/#CVE-2026-125271","url":"https://aws.amazon.com/security/security-bulletins/2026-176-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T17:00:47+00:00","fetched_at":"2026-11-10T17:00:47+00:00","note":"AWS: CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization"},{"source":"nvd","external_id":"CVE-2026-125271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125271","severity":null,"published_at":"2026-11-10T17:17:28+00:00","modified_at":"2026-11-10T17:17:28+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:45+00:00","note":null}],"documents":[{"id":116413,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-176-aws/","title":"AWS Security Bulletins: CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization","kind":"vendor","source":"vendor","publisher":null,"text":"CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization\n\nBulletin ID: 2026-176-AWS Publication Date: 11/10/2026 08:30 AM PST Description: We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for. Impacted versions: >= 0.2.13 AND < 1.5.1 Refer to the article for the most up-to-date and complete information.","published_at":"2026-11-10T16:42:37+00:00","relation":"mentions","confidence":null,"note":null},{"id":116444,"url":"https://aws.amazon.com/security/security-bulletins/2026-176-aws/","title":"AWS: CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization\n\n### CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization\n\nBulletin ID: 2026-176-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 08:30 AM PST\n\n Description:\n\nAWS API MCP Server is an open source Model Context Protocol (MCP) server that customers run to let AI assistants manage their AWS accounts through AWS API calls.\n\nWe identified CVE-2026-125271, an issue in the custom security policy enforcement of AWS API MCP Server versions between 0.2.13 and 1.5.0. The server normalized operation names incorrectly before comparing them to the operator's security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for.\n\nImpacted versions: >= 0.2.13 AND < 1.5.1\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-api-mcp-server version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading.\n\nReferences:\n\n- CVE-2026-125271\n- GHSA-4wq9-grf3-qg2p\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":116508,"url":"https://github.com/awslabs/mcp/security/advisories/GHSA-4wq9-grf3-qg2p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T16:34:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}