Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
AWS CLI Command Injection in aws-mcp-server Allows Remote Code Execution
CVE-2026-5059
Summary
An attacker can execute arbitrary code on aws-mcp-server installations without needing a password. This is a serious security risk because it allows unauthorized access to the server. Update aws-mcp-server to the latest version to fix this issue.
Original title
aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authe...
Original description
aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.
The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.
nvd CVSS3.0
9.8
Vulnerability type
CWE-78
OS Command Injection
Published: 11 Apr 2026 · Updated: 11 Apr 2026 · First seen: 11 Apr 2026