Live › vulnerability › GHSA-4prq-p2x5-w9fh
Go to dashboardThe AWS API MCP Server validates an OAuth bearer token's signature, issuer and expiry but does not check which application the token was issued for. A token issued by the same identity provider to a different application in the same tenant is accepted, which may let an attacker make AWS API calls with the credentials configured on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:39 UTC. All times on this page are UTC.
Only operators who run the AWS API MCP Server with the streamable-http transport and OAuth authentication are exposed, because only that configuration validates bearer tokens against an identity provider. The server must be on a version from 1.3.0 up to but not including 1.6.0. Teams on stdio transport, or on 1.6.0 or later, can skip it.
No product ranges from the sources yet.
awslabs.aws-api-mcp-server; versions >=1.3.0 and <1.6.0 are affected.AUTH_TYPE=oauth on the streamable-http transport.AUTH_AUDIENCE or AUTH_CLIENT_ID is set.awslabs.aws-api-mcp-server to 1.6.0 or later, and patch any forked or derivative code.AUTH_TYPE=oauth, set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers such as Amazon Cognito whose access tokens carry no audience claim.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
Bulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT
Description:
The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and <1.6.0, the server validates a token's signature, issuer and expiry, but not the claim identifying the application the token was issued for. A token that the nominated identity provider issued to another application in the same tenant is therefore accepted, which may allow AWS API calls to be made with the credentials configured on the host.
Impacted versions: >=1.3.0 AND <1.6.0
Resolution:
This issue has been addressed in awslabs.aws-api-mcp-server version 1.6.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito.
Workarounds:
Operators who cannot upgrade immediately can use the default stdio transport rather than the streamable-http transport.
References:
Acknowledgement:
We would like to thank Yuval Elbar (@YuvalElbar6) for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-4prq-p2x5-w9fh")