{"id":"CVE-2026-5059","kind":"vulnerability","aliases":["CVE-2026-5059","GHSA-fgmx-xfp3-w28p"],"related":[],"title":"aws-mcp has a Command Injection Remote Code Execution Vulnerability","description":"aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.","summary":"The aws-mcp MCP server fails to validate a user-supplied string in its allowed-commands handling before passing it to a system call. A remote attacker without credentials can execute arbitrary code in the context of the MCP server.","severity":"critical","cvss":9.8,"epss":0.01908,"exploited":false,"exploited_at":null,"products":[{"name":"aws-mcp","fixed":[],"affected":"<= 1.7.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","aws","aws-mcp","cwe-78","mcp","python","self-hosted"],"not_affected_if":["fixed-version","not-installed"],"how_to_check":"- Run `pip show aws-mcp` and check whether the installed version is `1.7.0` or lower\n- Check whether the MCP server is reachable from untrusted networks, since the sources say no authentication is required","fix":"- Upgrade `aws-mcp` to a version later than `1.7.0`; the fixed version is unknown from the sources\n- Until patched, restrict network access to the MCP server and do not expose it to the internet","status":"open","published_at":"2026-04-11T01:16:18+00:00","first_seen_at":"2026-10-27T15:23:43+00:00","triaged_at":"2026-10-27T15:25:14+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T15:25:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `aws-mcp` to a version later than `1.7.0`; the fixed version is unknown from the sources\n- Until patched, restrict network access to the MCP server and do not expose it to the internet","reach":"internet","title":"aws-mcp: unauthenticated command injection lets remote attackers run code","impact":"high","summary":"The aws-mcp MCP server fails to validate a user-supplied string in its allowed-commands handling before passing it to a system call. A remote attacker without credentials can execute arbitrary code in the context of the MCP server.","category":"ai-tooling","nicknames":[],"who_cares":["aws-mcp","mcp","python","aws","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the MCP server host","analyst_note":"Find the fixed aws-mcp version and the vulnerable allowed-commands code path in GHSA-fgmx-xfp3-w28p and the ZDI-CAN-27969 advisory.","how_to_check":"- Run `pip show aws-mcp` and check whether the installed version is `1.7.0` or lower\n- Check whether the MCP server is reachable from untrusted networks, since the sources say no authentication is required","needs_analyst":true,"not_affected_if":["not-installed","fixed-version"],"who_is_affected":"Teams running the aws-mcp-server package at version 1.7.0 or earlier, where the MCP server accepts remote requests. Exposure depends on whether the server is reachable by an attacker, which the sources do not detail further. Teams not running aws-mcp can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000646,"input_tokens":3448,"output_tokens":603,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-5059':14A,22A '-78':34B '27969':175C 'affect':105C 'ai':27B 'ai-tool':26B 'allow':57B,97C,129C 'allowed-command':56B 'arbitrari':74B,102C 'attack':69B,99C,156C 'authent':112C 'aw':2A,29B,31B,42B,84C,87C,109C 'aws':24A 'aws-mcp':1A,23A,30B,41B 'aws-mcp-serv':83C,108C 'call':66B,154C 'cli':88C 'code':9A,75B,92C,103C,163C 'command':6A,58B,89C,130C 'context':78B,166C 'credenti':71B 'cve':12A,20A 'cwe':33B 'execut':10A,73B,93C,101C,151C,162C 'exist':123C 'exploit':117C 'fail':46B 'fgmx':17A 'flaw':122C 'ghsa':16A 'ghsa-fgmx-xfp3-w28p':15A 'handl':59B,126C 'host':39B 'inject':7A,90C 'instal':106C 'issu':133C 'lack':137C 'leverag':158C 'list':131C 'mcp':3A,25A,32B,35B,43B,44B,81B,85C,110C,169C 'pass':61B 'proper':139C 'python':36B 'remot':8A,68B,91C,98C 'requir':115C 'result':134C 'self':38B 'self-host':37B 'server':45B,82B,86C,111C,170C 'specif':121C 'string':53B,146C 'suppli':52B,145C 'system':65B,153C 'tool':28B 'use':148C 'user':51B,144C 'user-suppli':50B,143C 'valid':48B,140C 'vulner':11A,94C,96C,119C,160C 'w28p':19A 'within':124C 'without':70B 'xfp3':18A 'zdi':173C 'zdi-can':172C","nicknames":[],"mitigations":[],"who_affected":"Teams running the aws-mcp-server package at version 1.7.0 or earlier, where the MCP server accepts remote requests. Exposure depends on whether the server is reachable by an attacker, which the sources do not detail further. Teams not running aws-mcp can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-11T01:16:18+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fgmx-xfp3-w28p","url":"https://github.com/advisories/GHSA-fgmx-xfp3-w28p","severity":"critical","published_at":"2026-04-11T03:30:30+00:00","modified_at":"2026-10-27T15:22:51+00:00","first_seen_at":"2026-10-27T15:23:43+00:00","fetched_at":"2026-10-27T15:28:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-5059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5059","severity":null,"published_at":"2026-04-11T01:16:18+00:00","modified_at":"2026-06-17T10:58:22+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}