AWS MCP Server: a crafted script got past the run_script validator
AWS MCP Server's Python code validator missed inputs that let an authenticated caller run arbitrary code in their own session.
· Amazon Web Services · Research by Manash Saikia
AWS MCP Server's run_script tool shipped an incomplete list of disallowed Python inputs, so an authenticated user could run arbitrary code inside their own sandboxed session. AWS says the fix is server-side.
01What happened
AWS published bulletin 2026-149 on October 23, 2026, assigning CVE-2026-115845 to a flaw in the run_script tool of AWS MCP Server. Manash Saikia reported it through the coordinated vulnerability disclosure process, AWS states. The advisory reached the GitHub Advisory Database the same day with a CVSS v4 base score of 5.3.
02How it works
run_script exists to execute Python inside a sandboxed environment, and a validator decides which inputs are allowed through. That validator's list of disallowed inputs was incomplete, the weakness class recorded as CWE-184, so a crafted script could reach code execution the validator was meant to block. Execution stayed inside the caller's own isolated session environment, which bounds the result.
03Who is affected
Authenticated users of AWS MCP Server are the only population in scope, and AWS describes the product as an exclusively hosted managed service, so there are no customer-run versions to match against. AWS adds that no workaround is needed for the tool's intended use, running Python scripts that make AWS API calls.
04What to do
No customer action is required, AWS states, because the issue was addressed service-side.
Sources 2 links, all fetched
- 1aws.amazon.comAWS Bulletin
- 2github.comGitHub Advisory