CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
CVE-2026-115812
Summary
Bulletin ID: 2026-149-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/23/2026 12:00 PM PDT
Description:
AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment.
We identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
Impacted versions: N/A (managed service, exclusively hosted)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.