Bulletin ID: 2026-152-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/27/2026 11:00 AM PDT
Description:
The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and <1.6.0, the server validates a token's signature, issuer and expiry, but not the claim identifying the application the token was issued for.
Impacted versions: >=1.3.0 AND <1.6.0
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the original article:
CVE-2026-115413 – AWS API MCP Server OAuth token audience validation bypass