CVE-2026-5058
aws-mcp-server Command Injection Remote Code Execution Vulnerability
CVSS Score
9.8
EPSS Score
1.0%
EPSS Percentile
77th
aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27968.
| CWE | CWE-78 |
| Vendor | aws-mcp-server |
| Product | aws-mcp-server |
| Published | Apr 11, 2026 |
| Last Updated | Apr 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for aws-mcp-server aws-mcp-server
Be the first to know when new critical vulnerabilities affecting aws-mcp-server aws-mcp-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Versions
aws-mcp-server / aws-mcp-server
1.3.0