MEDIUM 5.3 NVD

CVE-2026-115845

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execut

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.

References

https://aws.amazon.com/security/security-bulletins/2026-149-aws/

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-23 via NVD.

vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.