AWS repairs a token bug in its MCP server

On 27 October 2026, AWS told users about bug CVE-2026-115413 in its API MCP server. This open source server lets AI assistants use AWS services with command line tools. From version 1.3.0 until 1.6.0, it accepts a token that was made for a different app in the same tenant. An attacker can then use the credentials on the host.

How it works

The server checks the signature, the issuer and the expiry date of a token. It does not check the audience claim, the field that names the app that the token is for. A token that the same identity provider made for a different app goes through.

The fix

AWS repaired the bug in version 1.6.0. Operators that use OAuth must also set AUTH_AUDIENCE. They set AUTH_CLIENT_ID if the provider puts no audience in a token, as Amazon Cognito does. Operators that cannot upgrade can use the default stdio transport.

What is not known

AWS gives no number of users with the bug. It does not tell if an attacker used the bug. Yuval Elbar helped AWS with the bug.

Insight: The connector is the weak point, not the model

In October 2026, bugs hit the connectors between AI and tools. Anthropic had an OAuth bug, and an AWS database server let SQL comments through a read-only check. Each bug is in a check that the connector makes before the agent does a task. The weak point reads as the connector, not the model. Give each connector the same checks as a system that holds credentials.