CVE-2026-115413: AWS API MCP Server OAuth token audience validation bypass

CVE-2026-115413 · Severity: high · CVSS 7.8 · Published 2026-10-27

The AWS API MCP Server is an open-source tool that enables AI assistants to interact with AWS services through CLI commands. When configured with OAuth authentication, it fails to validate which application a token was issued for, allowing tokens from other applications in the same tenant to be accepted. An attacker with a token for a different application could make unauthorized AWS API calls using the server's credentials.

Technologies: Amazon AWS, AWS API MCP Server. Vendors: Amazon, AWS.

Quick answers

Is CVE-2026-115413 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115413 being exploited in the wild.
How severe is CVE-2026-115413?
High severity, with a CVSS score of 7.8, published 27 October 2026.
Which products and versions are affected?
AWS API MCP Server >=1.3.0, <1.6.0.
Is there a fix for CVE-2026-115413?
Yes: fixed in 1.6.0. Until then: Set AUTH_AUDIENCE or AUTH_CLIENT_ID when using AUTH_TYPE=oauth (the latter is necessary for identity providers like Amazon Cognito that do not include an audience claim in access tokens). Operators unable to upgrade immediately may use the default stdio transport instead of streamable-http. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115413 attacked?
It is attacked over the network.
Am I affected by CVE-2026-115413?
Check whether you run Amazon AWS or AWS API MCP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.6.0

Set AUTH_AUDIENCE or AUTH_CLIENT_ID when using AUTH_TYPE=oauth (the latter is necessary for identity providers like Amazon Cognito that do not include an audience claim in access tokens). Operators unable to upgrade immediately may use the default stdio transport instead of streamable-http.

Technical details

The vulnerability is an incomplete OAuth token validation in versions 1.3.0 through 1.5.x of the AWS API MCP Server. While the server validates token signature, issuer, and expiry, it omits validation of the audience claim that identifies the intended application. This allows cross-application token reuse within the same identity provider tenant when using the streamable-http transport with OAuth authentication.

Affected products

  • AWS API MCP Server >=1.3.0, <1.6.0

Timeline

  • 2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.