2026-04-11 · 2026-Q2

aws-mcp-server Unauthenticated RCE via Command Injection

Primary layerL6 Identity / RunSecondary:L5 Config L1 Credential

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Unknown
In the wild: No
Actor: Attacker

Target

aws-mcp-server (Model Context Protocol server for AWS CLI)

Impact

Unauthenticated remote attackers can execute arbitrary code on affected installations; full compromise of the MCP server and any AWS credentials it holds

Root cause

Missing validation of a user-supplied string passed to a system call; improper handling of the allowed commands list

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: aws-mcp-server Unauthenticated RCE via Command Injection (2026-04-11). https://agentprov.com/incidents/2026-04-11-aws-mcp-server-unauthenticated-rce-via-command-injection

Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run