CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
Bulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT Description: The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and Impacted versions: >=1.3.0 AND Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this art
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Anthropic
- Product
- AWS services, Claude, AI / LLM tooling
- Exposure class
- Cloud platform, AI infrastructure
Why it ranks 27 (Notable)
- Product class: cloud platform, AI infrastructure
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-115413 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.