Executive brief
A critical vulnerability has been identified in aws-mcp-server that allows remote attackers to take full control of the server. This tool is used to manage Model Context Protocol (MCP) services, and an exploit could allow an unauthorized user to run malicious commands without needing a password. This could lead to a total compromise of the server, including the theft of sensitive data or disruption of operations.
Technical details
The aws-mcp-server contains an OS command injection vulnerability (CWE-78) within its handling of the 'allowed commands' list. The root cause is a failure to properly validate user-supplied strings before they are passed to a system call. A remote, unauthenticated attacker can exploit this by sending specially crafted input to the server, resulting in arbitrary code execution with the privileges of the MCP server process. As of the advisory date, the vendor has reportedly rejected the vulnerability, and no official patch is available; users are advised to restrict network access to the service.
Affected products
- AWS aws-mcp-server
Timeline
- 2025-09-03: disclosed: Vulnerability reported to vendor
- 2026-03-30: advisory: Zero Day Initiative published the advisory as a 0-day after vendor rejection
- 2026-04-11: other: CVE published to NVD