---
id: "GHSA-4wq9-grf3-qg2p"
page: "https://infrastack.ai/live/GHSA-4wq9-grf3-qg2p"
kind: "vulnerability"
aliases: ["GHSA-4wq9-grf3-qg2p"]
title: "CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "aws-api-mcp-server", "lab-disclosure", "mcp"]
not_affected_if: ["no-custom-security-policy", "version-1.5.1-or-later"]
published_at: null
first_seen_at: "2026-11-10T17:00:47+00:00"
updated_at: "2026-11-10T17:02:37+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/2026-176-aws/", "first_seen_at": "2026-11-10T17:00:47+00:00"}]
exploit_sources: []
---

# CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Link for people: https://infrastack.ai/live/GHSA-4wq9-grf3-qg2p (this .md is for agents)

The AWS API MCP Server normalized operation names incorrectly, so operations with consecutive capital letters never matched the operator's denyList or elicitList entries. An actor could run AWS API operations that the operator's security policy was meant to deny or require confirmation for.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `awslabs.aws-api-mcp-server` version; affected versions are `>= 0.2.13` and `< 1.5.1`.
- Look for a custom security policy with `denyList` or `elicitList` entries on the server.

## Fix

- `awslabs.aws-api-mcp-server` upgrade to `1.5.1`
- Forked or derivative code: patch to include the new fixes (per AWS)

## Timeline

- 2026-11-10T17:00:47+00:00 lab https://aws.amazon.com/security/security-bulletins/2026-176-aws/ — AWS: CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

## Documents

- [advisory] AWS: CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization https://aws.amazon.com/security/security-bulletins/2026-176-aws/

## From the sources

CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

### CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Bulletin ID: 2026-176-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/10/2026 08:30 AM PST

 Description:

AWS API MCP Server is an open source Model Context Protocol (MCP) server that customers run to let AI assistants manage their AWS accounts through AWS API calls.

We identified CVE-2026-125271, an issue in the custom security policy enforcement of AWS API MCP Server versions between 0.2.13 and 1.5.0. The server normalized operation names incorrectly before comparing them to the operator's security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for.

Impacted versions: >= 0.2.13 AND < 1.5.1

Resolution:

This issue has been addressed in awslabs.aws-api-mcp-server version 1.5.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround other than upgrading.

References:

- CVE-2026-125271
- GHSA-4wq9-grf3-qg2p

Acknowledgement:

We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any s ecurity questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_