Quick Take
- What: CVE-2026-125271, a policy bypass in the AWS API MCP Server that let AI agents run blocked AWS operations when the operation name contained consecutive capital letters.
- Who is affected: Operators running awslabs.aws-api-mcp-server versions 0.2.13 up to (but not including) 1.5.1.
- What to do: Upgrade to version 1.5.1 or later and re-test any denyList or elicitList entries whose operation names contain consecutive capital letters.
- Fixed: Version 1.5.1, released August 10, 2026.
- Reported by: Syed Anas Mohiuddin through coordinated disclosure.
In plain English
The AWS API MCP Server is a tool that lets AI assistants run AWS command-line commands. A bug in how it checked operation names meant that if an operation name had two or more capital letters in a row, the server would not match it against the operator’s block list or approval list. So even if an operator wrote a rule to block or require approval for that operation, the AI agent could run it anyway. AWS fixed this in version 1.5.1.
What you should do: If you use this tool, you should upgrade and then check that your rules now work correctly for any operation names with consecutive capitals.
What happened
AWS published bulletin 2026-176 on November 10, 2026 for CVE-2026-125271 in the AWS API MCP Server, the server that lets an AI assistant run AWS CLI commands. Syed Anas Mohiuddin reported the vulnerability through coordinated disclosure.
PyPI dates the fixed release, 1.5.1, to August 10, 2026, three months before the bulletin appeared. PyPI also marks the package as superseded by the official AWS MCP server and points to a migration guide.
How it works
The AWS API MCP Server normalized operation names incorrectly before checking them against the operator’s policy. AWS states that operations with consecutive capital letters never matched a correctly written denyList or elicitList entry.
A name holding consecutive capital letters never matched the operator’s entry for it. The call went through instead of being denied or held for elicitation, and nothing in the exchange marked the rule as skipped.
What you should do
Upgrade awslabs.aws-api-mcp-server to version 1.5.1 or later. AWS says there is no workaround, and that forked or derivative code has to be patched separately.
After upgrading, re-test any denyList or elicitList entry whose operation name contains consecutive capital letters, to confirm the rule now matches.
What it means
This vulnerability allowed AI agents to bypass security policies silently. Operators who had configured deny or elicit rules for AWS operations with consecutive capitals in their names would have believed those rules were active, when in fact the agent could run those operations without restriction.
The affected version range is 0.2.13 up to (but not including) 1.5.1. Some exposed installs may be running past their replacement, as PyPI marks the package as superseded by the official AWS MCP server.
