CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
Bulletin ID: 2026-176-AWS Publication Date: 11/10/2026 08:30 AM PST Description: We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for. Impacted versions: >= 0.2.13 AND Refer to the article for the most up-to-date and complete information.
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Anthropic
- Product
- Claude, AI / LLM tooling
- Exposure class
- AI infrastructure
Why it ranks 40 (Notable)
- Product class: AI infrastructure
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-125271 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.