CVE-2026-125271

Vendor

AWS

Product

aws-api-mcp-server

CVSS v3.1

7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness

CWE-863, CWE-1025

Exposure class

AI infrastructure

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 40
   AWS bulletin AWS 2h ago

   CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

   Bulletin ID: 2026-176-AWS Publication Date: 11/10/2026 08:30 AM PST Description: We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s…

   CVE-2026-125271 Amazon Web Services Anthropic
2. 30
   CVE NVD 2h ago

   Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor…

   Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security…

   CVSS 7.8 Fix available CVE-2026-125271 AWS