Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
62 items
CVE-2026-115413 affects the AWS API MCP Server in versions >=1.3.0 and <1.6.0 when it runs the streamable-http transport with OAuth authentication. The server checks a bearer token's signature, issuer and expiry but not the application audience claim, so a token issued to another application in the same tenant is accepted. This may allow AWS API calls using the credentials configured on the host.
Fix: Fixed in awslabs.aws-api-mcp-server version 1.6.0. Operators using AUTH_TYPE=oauth should also set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito. Workaround: use the default stdio transport rather than streamable-http.
AWS Security BulletinsCVE-2026-116635 affects the deployment status component of the AWS Serverless MCP Server, versions below v0.2.1 of awslabs.aws-serverless-mcp-server. Under certain conditions, an improper limitation of a pathname to a restricted directory might let an actor who can influence the MCP agent read JSON files outside the intended deployment status directory. Where write access has been enabled, the same flaw might allow creating or overwriting JSON files outside that directory.
Fix: Fixed in v0.2.1 of awslabs.aws-serverless-mcp-server.
CVE-2026-120497 is a stored cross-site scripting flaw in the HTML report generator of the aidlc-traceability CLI, an open source tool formerly published in the awslabs/aidlc-workflows repository. An actor who can modify a project's AI-DLC artifact files can embed script through crafted artifact titles or descriptions, which then runs in the browser of a user who opens a generated HTML traceability report. Affected versions are >=0.1.0 and earlier than commit 96cf0ea.
Fix: Fixed in commit 96cf0ea (fixed 2026-07-03).
AWS Security BulletinsCVE-2026-115415 affects the environment tool in Strands Agents Tools, versions >= 0.1.0 and < 0.8.6. The tool accepted a masking parameter from the LLM through its tool schema, so a crafted prompt in content the agent processes could turn masking off and return the host's environment variables in cleartext, including cloud credentials and API keys, without operator consent.
Fix: Fixed in 0.8.6 or later. Refer to AWS Security Bulletin 2026-154-AWS for the most up-to-date and complete information.
AWS Security BulletinsStrands Agents SDK, shipped as strands-agents for Python and @strands-agents/sdk for TypeScript, shares conversation history across callers with different context_id values in the Agent2Agent (A2A) server under certain circumstances. An authenticated remote user in a multi-tenant deployment can read another caller's conversation history or influence model behavior for that caller (CWE-488). Affected versions are strands-agents below 1.43.0 for Python and @strands-agents/sdk below 1.5.0 for TypeScript.
Upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript), which use an agent factory to isolate conversation state per A2A context_id. Ensure any forked or derivative code incorporates the fixes. Until upgrading, do not expose an A2A server to more than one user or tenant; if multiple callers need access, run a separate A2A server instance for each user or tenant. The source states there is no workaround that fully addresses the issue in affected versions.
AWS MCP Server, a managed server that gives AI agents access to AWS through the Model Context Protocol, has an incomplete validation flaw tracked as CVE-2026-115845 in the Python code validator of its run_script tool. An authenticated remote user might exploit a crafted script to execute arbitrary code within their own isolated session environment.
CVE-2026-115419 affects the Agent2Agent (A2A) server component of the Strands Agents SDK, which exposes an agent over HTTP. The A2A server did not properly isolate conversation state between callers, so an authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. Impacted versions are strands-agents (Python) containing the multiagent.a2a module below 1.43.0, and @strands-agents/sdk (TypeScript) below 1.5.0.
CVE-2026-112408 affects the default_bucket() function in the Amazon SageMaker Python SDK, which uses a predictably named S3 bucket without checking that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials. Impacted versions are V2 before 2.257.3 and V3 from 3.0.0 before 3.10.0.
Fix: Fixed in V2 2.257.3 and V3 3.10.0, per the impacted version ranges given in the source.
AWS Security BulletinsCVE-2026-112380 is an authorization flaw in the WhatsApp channel and the internal subagent run-control endpoints of Kiro Crew, affecting versions >=0.4.0 and <0.7.2. In configurations where a WhatsApp group was added to allowed groups or the direct-message policy was set to open, a group member could send instructions to another session's subagent, which executed them on the operator's machine, with the audit trail attributed to the operator. The default configuration is not affected.
CVE-2026-110248 affects the git_utils.py component of the Amazon SageMaker Python SDK, an open source library for training and deploying machine learning models on Amazon SageMaker. When a Git clone operation fails, repository credentials in subprocess error output are written to CloudWatch Logs without redaction, and an authenticated remote user with access to those logs can obtain the plaintext credentials.
The bedrock-agentcore-starter-toolkit, an AWS-maintained Python package distributed via GitHub and PyPI for importing Amazon Bedrock Agents into local environments, has two issues affecting versions >= 0.1.4 and <= 0.3.13. CVE-2026-105812 is a code injection flaw that could allow arbitrary code execution when a specially crafted agent is imported and then run or deployed. CVE-2026-106032 is an external reference handling flaw that could cause unintended network requests or local file access during agent import.
CVE-2026-104019 is an OS command injection flaw in the startup script that runs when a SageMaker Space starts in Amazon SageMaker Unified Studio. The script's network validation against project connections does not sanitize connection details, so under certain conditions arbitrary code can run in another project member's Space. In projects with Trusted Identity Propagation enabled, a user with contributor permissions or higher could obtain another member's temporary execution role credentials and call downstream services on that member's behalf.
Fix: Fixed in all supported SageMaker Distribution versions by sanitizing connection details during startup validation. The fix is deployed globally and applies to Spaces automatically on their next startup. Versions 2.8.x through 2.13.x are affected with no fix, as they are end of support.
Three issues in Loom for AWS, an AI agent orchestration platform, were addressed. CVE-2026-103956 (CWE-306, CWE-1188) let any network client gain full administrative control of the agent control plane in versions below 1.6.1 when no identity provider was configured, and this was fixed in 1.6.1. CVE-2026-103957 and CVE-2026-103958 (CWE-918, CWE-201) affect versions below 1.7.0 and let an authenticated user with the mcp:write or a2a:write scope exploit OAuth2 discovery handling and tool server or remote agent connections, leading to credential disclosure or access to arbitrary internal network locations.
Fix: Upgrade to the latest version, 1.7.0, and ensure any forked or derivative code is patched to incorporate the new fixes.
CVE-2026-97662 is an argument injection flaw in the diff scan operation of security-agent-mcp-server, an open-source MCP server published by AWS in the awslabs/mcp repository. Affected versions are 0.1.1 up to but not including 0.2.0. A crafted reference value is parsed as a command-line option instead of a revision, letting a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the workspace directory and bypass the server's workspace-confinement control.
Missing symlink validation in Language Servers for AWS (aws/language-servers) may allow an arbitrary file write outside the workspace trust boundary. Impacted versions are Language Servers for AWS <1.69.0. The agent may follow a symlink inside a trusted workspace to an external location and write there without prompting the user for approval.
Language Servers for AWS, the runtime behind Amazon Q Developer's IDE plugins, contains an improper trust boundary enforcement flaw in versions <1.65.0. When a local user opens a maliciously crafted workspace and trusts it, commands defined in project-level configuration files may execute automatically, giving arbitrary code execution on the user's host.
CVE-2026-95985 affects the file write tool in Kiro IDE, an agentic desktop IDE, before version 1.0.242. The flaw may let remote unauthenticated actors execute arbitrary commands and inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository opened as an untrusted workspace, sending any message can cause the agent to modify auto-loaded global configuration paths.
The GPTranslate WordPress plugin, all versions up to and including 2.34.6, exposes sensitive information through the enqueue_frontend_scripts function (CVE-2026-89278). Unauthenticated attackers can fetch any public page, apply the inverse transformation bundled in the plugin's public JavaScript asset, and recover the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation). The exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers, while deepseek-* models and gpt-* models in server-proxy mode suppress key emission.
CVE-2026-87912 affects the AWS Security Agent plugin in aws-agents-for-devsecops before version 1.1.0, and CVE-2026-87913 affects the AWS Security Agent MCP server before 0.2.0. Both stem from missing S3 bucket ownership verification, which may let remote attackers obtain the private source archive of a scanned workspace, including credentials and infrastructure state, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. Impacted versions are <=1.0.0 and >=0.1.0 AND <=0.1.5.
CVE-2026-85788 affects awslabs.mysql-mcp-server versions 1.0.21 and earlier, a self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI. Under certain conditions, SQL inline comments could bypass the server's read-only enforcement, letting a statement run that the check was meant to block. The source states the read-only mode is a best-effort safeguard, and the effective boundary is the permissions of the configured MySQL user.
Fix: Fixed in AWS Language Servers version 1.69.0. Upgrade to the latest version and ensure any forked or derivative code is patched with the new fixes. No workarounds are available.
GitHub Advisory DatabaseFix: Fixed in Language Servers for AWS version 1.65.0. Upgrade to the latest version and ensure any forked or derivative code incorporates the fix. No workarounds are available.
GitHub Advisory DatabaseFix: Fixed in 1.0.242 or later. Impacted versions: < 1.0.242.
AWS Security BulletinsFix: Upgrade the aws-agents-for-devsecops plugin to version 1.1.0 or later, and the AWS Security Agent MCP server to version 0.2.0 or later.
AWS Security Bulletins