medium5.3
CVE-2026-115845
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execu…
Impact
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aws | AWS MCP Server | Version N/A |