CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

Summary

CVE-2026-115413 affects the AWS API MCP Server in versions >=1.3.0 and <1.6.0 when it runs the streamable-http transport with OAuth authentication. The server checks a bearer token's signature, issuer and expiry but not the application audience claim, so a token issued to another application in the same tenant is accepted. This may allow AWS API calls using the credentials configured on the host.

Mitigation

Fixed in awslabs.aws-api-mcp-server version 1.6.0. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito. Workaround: use the default stdio transport rather than streamable-http.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database
• MediumCVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP ServerSame vendor · AWS Security Bulletins