CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK
CVE-2026-124034
Summary
Bulletin ID: 2026-176-AWS
Publication Date: 11/10/2026 08:30 AM PST
Description:
We identified CVE-2026-125271 of AWS API MCP Server. The server normalized operation names incorrectly before comparing them to the operator ' s security policy, so operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry. This might allow an actor to execute AWS API operations that the operator's security policy was configured to deny or require elicitation for.
Impacted versions: >= 0.2.13 AND < 1.5.1
Refer to the article for the most up-to-date and complete information.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.