AWS API MCP Server: consecutive capitals void a deny rule
A naming quirk silently voided deny and elicit rules in the AWS API MCP Server, so an agent could run AWS operations an operator had blocked.
· AWS · Research by Syed Anas Mohiuddin
The AWS API MCP Server normalized operation names incorrectly before checking them against the operator's policy, so AWS says operations with consecutive capital letters never matched a correctly written denyList or elicitList entry.
01What happened
AWS published bulletin 2026-176 on November 10, 2026 for CVE-2026-125271 in the AWS API MCP Server, the server that lets an AI assistant run AWS CLI commands. Syed Anas Mohiuddin reported it through coordinated disclosure. PyPI dates the fixed release, 1.5.1, to August 10, 2026, three months before the bulletin appeared.
02How it works
Operation names were normalized the wrong way before the policy check ran, so a name holding consecutive capital letters never matched the operator's entry for it. AWS states that a correctly written denyList or elicitList entry for such an operation therefore had no effect at all. The call went through instead of being denied or held for elicitation, and nothing in the exchange marked the rule as skipped.
03Who is affected
Operators running the version range listed below, which ends just short of 1.5.1, are affected. PyPI also marks the package as superseded by the official AWS MCP server and points to a migration guide, so some of the exposed installs are running past their replacement.
04What to do
Upgrade awslabs.aws-api-mcp-server to 1.5.1 or later; AWS says there is no workaround, and that forked or derivative code has to be patched separately. Then re-test any denyList or elicitList entry whose operation name contains consecutive capital letters, to confirm the rule now matches.
Sources 2 links, all fetched
- 1aws.amazon.comAWS Bulletin 2026-176
- 2pypi.orgPyPI Package