Live › vulnerability › CVE-2026-5059
Go to dashboardThe aws-mcp MCP server fails to validate a user-supplied string in its allowed-commands handling before passing it to a system call. A remote attacker without credentials can execute arbitrary code in the context of the MCP server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:23 UTC, 0h before NVD. All times on this page are UTC.
Teams running the aws-mcp-server package at version 1.7.0 or earlier, where the MCP server accepts remote requests. Exposure depends on whether the server is reachable by an attacker, which the sources do not detail further. Teams not running aws-mcp can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aws-mcp | pypi | <= 1.7.0 | – |
pip show aws-mcp and check whether the installed version is 1.7.0 or loweraws-mcp to a version later than 1.7.0; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.
This page as .md · .json · in your agent: get_signal("CVE-2026-5059")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.