CVE-2026-5059: Critical RCE in Amazon's Official MCP Server Package — Patch Immediately

Amazon’s official aws-mcp-server package contains a CVSS 9.8 critical remote code execution vulnerability — CVE-2026-5059 — that requires no authentication to exploit. Publicly disclosed April 11, 2026. If you have this running anywhere, patch it now.

What it is: aws-mcp-server is part of the awslabs/mcp monorepo — Amazon’s official toolkit for connecting MCP-compatible AI agents to AWS services. The package takes an “allowed commands” list and dispatches them to the underlying AWS CLI. The vulnerability exists because the server fails to properly validate user-supplied input before passing it to the system call. Classic unsanitized input → shell injection, wrapped in a modern AI infrastructure package.

Why this is particularly dangerous:

MCP is the glue layer between AI agents and external services. That means the entity supplying commands to the MCP server isn’t necessarily a human — it’s often an LLM. Any AI agent connected to a vulnerable aws-mcp-server instance is a potential attack vector. A malicious tool call, a compromised upstream model response, or a prompt injection attack that causes the LLM to generate a crafted input can trigger the injection without any direct network access from an attacker.

In short: the threat model for this vulnerability isn’t just “attacker on the same network.” It includes anyone who can influence what the connected AI agent says.

CVE details:

• CVE ID: CVE-2026-5059 (related: CVE-2026-5058, same package, different injection path)
• CVSS: 9.8 Critical
• Attack vector: Network
• Authentication: None required
• Impact: Remote code execution as the MCP server process user
• Affected: aws-mcp-server from awslabs/mcp — versions before the April patch release

Fix:

npm update @awslabs/aws-mcp-server

Check the awslabs/mcp GitHub releases page for the exact patched version tag. If you deployed aws-mcp-server as part of an agent infrastructure pipeline and haven’t patched, treat the host as potentially compromised and audit access logs.

Context: MCP crossed 97 million monthly downloads in March 2026. AWS services are the backbone of a significant share of AI agent deployments. The combination of widespread adoption, no-auth exploitation, and LLM-as-attack-surface makes CVE-2026-5059 one of the more structurally dangerous vulnerabilities in the current developer ecosystem.

Prompt injection has moved from theoretical concern to demonstrated attack technique. CVE-2026-5059 is the kind of vulnerability where those two threat vectors converge. Update, audit, and review what’s connected to your MCP servers.