CVE-2026-115413: AWS API MCP Server accepted OAuth tokens issued to other apps, letting them run AWS commands with the server's credentials
AWS's open source AWS API MCP Server, which lets AI assistants run AWS CLI commands, checked an OAuth token's signature, issuer and expiry but not which application it was issued for. With the streamable-http transport and OAuth on, a token the same identity provider issued to another app, such as a second app client in the same Cognito user pool, could be used to make AWS calls with the host's credentials. Fixed in awslabs.aws-api-mcp-server 1.6.0.
What it is
Affected deployments serve the streamable-http transport with OAuth authentication against an identity provider the operator chooses. The server did not validate the token's audience or client claim.
A local caller holding a token issued to another application in the same tenant could reach the server and make AWS API calls with the credentials configured on the host, limited only by those credentials' permissions.
The default stdio transport is not affected.
How to check
- Affected: awslabs.aws-api-mcp-server (PyPI) 1.3.0 to before 1.6.0, only when run with the streamable-http transport and OAuth authentication.
How to fix
- Upgrade awslabs.aws-api-mcp-server to 1.6.0 or later and configure the expected token audience or client ID, which 1.6.0 requires for OAuth.
- Until then, use the default stdio transport instead of streamable-http, and keep the server's AWS credentials least-privilege.
pip show awslabs.aws-api-mcp-server | grep -i versionSources
- criticalCVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commands
- criticalMalicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude
- criticalCVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev server
- criticalCVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress