CVE-2026-115413

Vendor

AWS

Product

aws-api-mcp-server

CVSS v3.1

7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness

CWE-346

Exposure class

Cloud platform, AI infrastructure

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 27
   AWS bulletin AWS 4d ago

   CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

   Bulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT Description: The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI…

   CVE-2026-115413 Amazon Web Services Anthropic
2. 22
   CVE NVD 4d ago

   Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS…

   Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued…

   CVSS 7.8 Fix available CVE-2026-115413 AWS