Description
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters.



To remediate this issue, users should upgrade to version 1.5.1.
Published: 2026-11-10
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Description Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters. To remediate this issue, users should upgrade to version 1.5.1.
Title AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
First Time appeared Aws
Aws aws-api-mcp-server
Weaknesses CWE-1025
CWE-863
CPEs cpe:2.3:a:aws:aws-api-mcp-server:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-api-mcp-server
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aws Aws-api-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-11-10T16:35:38.381Z

Reserved: 2026-11-09T18:28:57.011Z

Link: CVE-2026-125271

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses