{"data":{"id":"53437374-c9d8-4270-b537-a3e790bc2b20","title":"CVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization","summary":"CVE-2026-125271 affects AWS API MCP Server, versions 0.2.13 up to but not including 1.5.1. The server normalized operation names incorrectly before checking them against the operator's security policy, so operations with consecutive capital letters in their names never matched a correctly written denyList or elicitList entry. This may let an actor run AWS API operations the policy was configured to deny or require elicitation for.","solution":"Refer to the article for the most up-to-date and complete information.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-176-aws/","publishedAt":"2026-11-10T16:42:37.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS API MCP Server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-10T16:42:37.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}