AI & LLM Vulnerabilities

Two vulnerabilities (CVE-2026-87912 and CVE-2026-87913) were found in AWS Security Agent plugins where the system doesn't verify that an S3 bucket (cloud storage container) actually belongs to the account using it. This allows attackers to intercept private source code archives containing sensitive data like credentials and infrastructure information by creating buckets with predictable names based on publicly known account identifiers.

A vulnerability was found in awslabs mysql-mcp-server (a Model Context Protocol server, which is software that helps AI models interact with MySQL databases) versions 1.0.21 and earlier. An attacker could bypass the read-only protection by using SQL inline comments (special text that gets ignored by the database), allowing them to run commands that should have been blocked. However, the read-only mode is only a basic safeguard, and the real protection depends on the database user permissions (access rules) that are set up.

CVE-2026-85787 is a vulnerability in Amazon's postgres-mcp-server (a tool for connecting AI systems to PostgreSQL databases) where the SQL validation component doesn't block all dangerous inputs, allowing attackers to craft malicious SQL commands that let them modify data they shouldn't be able to access, even though the server is supposed to be read-only (restricted to viewing data only).

Amazon awslabs.dynamodb-mcp-server, an open-source tool that lets AI assistants work with Amazon DynamoDB (a database service), has a code injection vulnerability in its CDK generator (the part that creates infrastructure-as-code templates). An attacker could craft malicious table or attribute names in a data model file to execute arbitrary code on the host machine that deploys the generated application.

Helicone, a platform for managing AI services, has a security flaw in its VaultManager.getDecryptedProviderKeyById() function (the code that retrieves and decrypts API keys) where it doesn't check whether the person requesting a key actually belongs to the organization that owns it. This means attackers with admin or owner privileges in one organization can steal decrypted API keys (like OpenAI or Anthropic credentials) from completely different organizations.

Amazon SageMaker Python SDK stores HMAC keys (cryptographic secrets used to verify data hasn't been tampered with) in plain text in pipeline definitions, allowing users with DescribePipeline permissions to read these keys and inject malicious code into other users' pipeline executions within the same AWS account. The vulnerability affects SageMaker Python SDK v3 versions before v3.11.0 and v2 versions before v2.256.0.

GitLab fixed a vulnerability in its AI Gateway component (a service that handles AI requests) affecting versions 18.9.0 through 19.2.2 that could let an authenticated user with Duo Agent Platform access redirect AI model requests to an outside server they control, potentially exposing cloud service credentials (login credentials for Google Vertex AI or AWS Bedrock).

A security flaw (CVE-2026-78379) in Strands Agents Tools, a Python SDK for building AI agents, allows attackers to bypass the approval prompt in the python_repl tool (which normally requires human consent before running Python code on a system). An attacker can craft a malicious prompt that uses the batch tool to sneak in a keyword argument, letting them execute arbitrary Python code without permission.

CVE-2026-18954 is an authorization bug in Amazon DocumentDB MCP Server (a tool that lets AI assistants access databases). The bug allows certain database operations called aggregation pipeline stages ($out and $merge, which are write operations) to bypass read-only protections, potentially letting an authenticated user make unwanted changes to the database.

A vulnerability exists in AWS Transform MCP Server (a tool that lets AI assistants run code-transformation jobs on a developer's local machine) versions 0.1.0 through 0.1.4. An attacker could exploit improper pathname validation in the get_resource tool to write files anywhere on the system outside the intended directory, potentially leading to local code execution (unauthorized commands running on the developer's computer).

A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.

A prompt injection vulnerability (tricking an AI by hiding instructions in its input) in the shell tool of Amazon Strands Agents Tools before version 0.8.0 allows attackers to run arbitrary operating system commands on the agent's host computer by crafting a prompt that sets the non_interactive parameter to true, which bypasses the requirement for human approval.

AWS Bedrock AgentCore Python SDK has a vulnerability in the install_packages() method where improper input validation allows remote authenticated users to execute arbitrary commands in a Code Interpreter sandbox by crafting malicious package names. The issue affects versions before 1.18.1.

The AWS API MCP Server (a tool that lets AI assistants interact with AWS services) has a security bug where if the security policy data fails to load when the server starts, the security checks are skipped for the entire time the server runs. This means users can perform AWS operations that should be blocked by the security policy, though AWS account permissions (IAM, the system that controls who can access what in AWS) still apply.

A vulnerability (CVE-2026-16796) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method that fails to properly validate package name inputs, allowing an authenticated attacker to run arbitrary commands (code execution) within the sandbox environment where Python packages are installed. This affects versions of bedrock-agentcore before 1.18.1.

The AWS API MCP Server (a tool that lets AI assistants run AWS commands on a user's account) has a security flaw where if the startup process fails to load its security policy rules, the server keeps running but stops checking those rules for the rest of its lifetime. This means an attacker could trick the startup into failing and then execute AWS operations that the policy was supposed to block. The underlying AWS account permissions still apply, but the policy-based restrictions are bypassed.

AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.