CVE-2026-115845 in MCP Server
Summary
by MITRE • 10/23/2026
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
AWS fixed this issue service-side. No customer action is required.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified involves a flaw in the input validation logic of the Python code validator utilized by the run_script tool within the AWS MCP Server architecture. This component serves as an intermediary for executing scripts, and its primary security function relies on filtering out potentially malicious inputs to prevent unauthorized actions or system compromise. However, the implementation contains an incomplete list of disallowed inputs, meaning that certain specific patterns or payloads were not adequately restricted by the validation mechanism. This oversight creates a gap in the defense-in-depth strategy typically employed for script execution environments, allowing attackers who have authenticated access to bypass expected security controls through carefully crafted input sequences.
From a technical perspective, this flaw represents an instance of Improper Input Validation, which is categorized under CWE-20 in the Common Weakness Enumeration standard. The core issue lies in the failure to rigorously sanitize or reject all forms of potentially dangerous code constructs before they are passed to the execution engine. While the environment is designed to be isolated for each user session, ensuring that one tenant cannot directly access another's data, the lack of comprehensive input filtering allows an authenticated remote user to inject arbitrary commands or logic into their own session context. This capability effectively transforms a standard script execution tool into a vector for code injection attacks within the boundaries of the user's allocated resources.
The operational impact of this vulnerability is significant despite the isolation constraints. An attacker with valid credentials can exploit this weakness to execute arbitrary code within their isolated session environment. While direct lateral movement or cross-tenant data exfiltration may be hindered by the sandboxing mechanisms, the ability to run unrestricted code poses severe risks including resource exhaustion through CPU-intensive loops, local privilege escalation if the isolation boundaries are flawed, and potential compromise of any credentials or secrets stored locally within that specific session context. Furthermore, malicious scripts could attempt to communicate with external command-and-control servers from within the permitted network egress rules associated with the user's environment, leading to data leakage or further reconnaissance activities against other services accessible from that VPC or subnet.
This type of vulnerability aligns with techniques observed in the MITRE ATT&CK framework, particularly those related to Command and Scripting Interpreter abuse such as T1059. The attacker leverages a legitimate system utility for unintended purposes by bypassing input restrictions, which is a common tactic in post-exploitation phases where initial access has already been established through authentication credentials. The use of crafted scripts allows the adversary to automate complex tasks or maintain persistence within the compromised session without triggering immediate alerts associated with more obvious malicious binaries.
AWS addressed this security concern by implementing fixes on the service side, specifically enhancing the input validation logic in the Python code validator to ensure that a comprehensive set of disallowed inputs is properly blocked. This remediation closes the gap identified in the original implementation and restores the integrity of the isolation boundaries for all users. Because the fix was deployed server-side within the AWS infrastructure, no action is required from customers who utilize this service. The update ensures that future script executions are subjected to stricter validation checks, thereby mitigating the risk of arbitrary code execution via crafted inputs while maintaining the intended functionality and performance characteristics of the run_script tool for legitimate use cases.