early signals AWS security bulletins

CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

// summary

CVE-2026-115845 concerns incomplete validation in the Python sandbox used by AWS MCP Server's run_script tool.

// from the source

Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment. We identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an auth
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins

    CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server

    aws.amazon.com
  2. AWS security bulletins infra

    CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

    aws.amazon.com
  3. AWS security bulletins

    CVE-2026-87911

    aws.amazon.com
  4. AWS security bulletins infra

    CVE-2026-85788 - Issue with awslabs mysql-mcp-server

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

    aws.amazon.com