Executive brief
AWS API MCP Server is a cloud service component used to manage API access and security policies in Amazon Web Services. A vulnerability in its startup process allows security policies to be bypassed under certain failure conditions, potentially enabling unauthorized access to protected resources or API operations that should have been restricted.
Technical details
CVE-2026-16584 describes a security policy bypass vulnerability in AWS API MCP Server that occurs during startup failure scenarios. The vulnerability allows an attacker to circumvent security policy enforcement when the server fails to start properly. The exact attack vector and preconditions are not fully detailed in the available advisory content, but the issue likely affects deployments where startup failures are not properly handled or validated. AWS has published this as a high-severity issue and users should apply any available patches or security updates to affected deployments.
Affected products
- AWS API MCP Server
Timeline
- 2026-09-22: disclosed