On 10 November, AWS published a security bulletin and a GitHub security advisory about a flaw in the AWS API MCP Server’s custom security policies. The flaw affects versions 0.2.13 to 1.5.0.

AWS API MCP Server is an open-source MCP server that users run themselves. MCP is a protocol through which an AI assistant uses external tools. Here, the assistant manages an AWS account through AWS API calls. The operator can define a custom security policy for the server. Operations listed in its denyList are blocked, and those in its elicitList require user confirmation before they run.

Why the rules failed

The server normalises operation names into a consistent format before comparing them with the policy. AWS said the server normalised names containing consecutive capital letters incorrectly. As a result, even a correctly written denyList or elicitList entry never matched such an operation.

The CVE description says the flaw could let through operations across multiple AWS services. Examples in the GitHub advisory include creating a federated identity provider, deactivating an MFA (multi-factor authentication) device and deleting database clusters.

Who is affected

The flaw affects only a locally run server whose custom policy lists affected operations. The user must also be using an AI assistant. The AWS API MCP Server that AWS offers as a remote service is not vulnerable. Nor does the flaw affect the READ_OPERATIONS_ONLY and REQUIRE_MUTATION_CONSENT settings.

The CVE record and the GitHub advisory rate the flaw High, with a CVSS 4.0 score of 8.5. AWS’s own bulletin classes it as Important.

Upgrading is the only fix

AWS said only upgrading to version 1.5.1 or later fixes the flaw, and there is no workaround. The company urges users to patch forks and other derivatives of the server as well.

Japanese technology site Tech InnovateIT reminds readers that the MCP server must be restarted after the upgrade. Restricting IAM permissions adds protection but does not replace the upgrade, the site says. It advises testing deny rules and confirmation prompts in a development or test environment, not in a production account.

Tech InnovateIT reported that the latest version on PyPI on 11 November was 1.6.0, which also fixes a separate missing OAuth check. The developer’s separate security advisory, the site wrote, advises setting the expected token audience or client ID when version 1.6.0 is used with streamable-http transport and OAuth. The setting is not needed in every configuration, for example with stdio.

The site also reported that PyPI directs users to the AWS MCP Server, named as the successor. Citing the developer’s migration guide, it said development of new features ended on 15 July 2026 and the server is due to be removed on 15 July 2027.