{"data":{"id":"98216d30-7528-4384-bd18-46466a754edf","title":"GHSA-29w2-fq35-v728: AWS API MCP Server Security Policy Bypass via Startup Initialization Failure","summary":"The AWS API MCP Server (a tool that lets AI assistants interact with AWS services) has a security bug where if the security policy data fails to load when the server starts, the security checks are skipped for the entire time the server runs. This means users can perform AWS operations that should be blocked by the security policy, though AWS account permissions (IAM, the system that controls who can access what in AWS) still apply.","solution":"This issue has been addressed in version 1.3.47. AWS recommends upgrading to the latest version. Until you upgrade, you can prevent the bypass by using least-privilege IAM credentials (restricted permissions like ReadOnlyAccess) or by restarting the server once network connectivity is restored if it started during connection problems.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-29w2-fq35-v728","publishedAt":"2026-07-24T22:33:19.000Z","cveId":"CVE-2026-16584","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["awslabs.aws-api-mcp-server@>= 0.2.13, < 1.3.47 (fixed: 1.3.47)"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS","AWS API MCP Server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0013,"patchAvailable":true,"disclosureDate":"2026-07-24T22:33:19.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}