# CVE-2026-16584: AWS AWS API MCP Server security policy bypass via initialization failure

Source: https://junglewise.ai/threats/cve-2026-16584-aws-aws-api-mcp-server-security-policy-bypass-via-initialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16584 · Severity: high · CVSS 7 · Published 2026-07-23

AWS API MCP Server is a cloud service component used to manage API access and security policies in Amazon Web Services. A vulnerability in its startup process allows security policies to be bypassed under certain failure conditions, potentially enabling unauthorized access to protected resources or API operations that should have been restricted.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [AWS API MCP Server](https://junglewise.ai/threats/technologies/api-mcp-server). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [AWS](https://junglewise.ai/threats/vendors/aws), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-16584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16584 being exploited in the wild.

**How severe is CVE-2026-16584?** High severity, with a CVSS score of 7, published 23 July 2026.

**Which products and versions are affected?** Aws-Api-Mcp-Server >= 0.2.13, < 1.3.47; awslabs.aws-api-mcp-server (PyPI) >= 0.2.13, < 1.3.47, ECOSYSTEM:introduced=0.2.13,fixed=1.3.47.

**Is there a fix for CVE-2026-16584?** Yes. awslabs.aws-api-mcp-server (PyPI): upgrade to 1.3.47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16584 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-16584?** Check whether you run Amazon AWS, AWS API MCP Server, Aws-Api-Mcp-Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- awslabs.aws-api-mcp-server (PyPI): upgrade to 1.3.47 or later

  ```sh
  pip install "awslabs.aws-api-mcp-server>=1.3.47"
  ```


## Technical details

CVE-2026-16584 describes a security policy bypass vulnerability in AWS API MCP Server that occurs during startup failure scenarios. The vulnerability allows an attacker to circumvent security policy enforcement when the server fails to start properly. The exact attack vector and preconditions are not fully detailed in the available advisory content, but the issue likely affects deployments where startup failures are not properly handled or validated. AWS has published this as a high-severity issue and users should apply any available patches or security updates to affected deployments.

## Affected products

- AWS API MCP Server

## Identifiers

- CVE-2026-16584
- GHSA-29w2-fq35-v728
- PYSEC-2026-3549

## Timeline

- 2026-09-22: disclosed

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-063-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-063-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)