aws-mcp has a Command Injection Remote Code Execution Vulnerability

aws-mcp (pip)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list.

First seen: 11 Apr 2026
Last update: 11 Apr 2026, 03:30 UTC
Identifiers: CVE-2026-5059
Source: GitHub advisory
On the menu as: PyPI packages
AWS

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## aws-mcp has a Command Injection Remote Code Execution Vulnerability
Severity: critical. Patch status: no fix yet.
Affected: aws-mcp (pip)
Ids: CVE-2026-5059

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list.

## Steps
1. This incident involves a provider (aws). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.
2. There is no fix yet. Until one ships: restrict network access to it.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-5059") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-fgmx-xfp3-w28p https://github.com/pypa/advisory-database/tree/main/vulns/aws-mcp/PYSEC-2026-288.yaml https://nvd.nist.gov/vuln/detail/CVE-2026-5059 https://pypi.org/project/aws-mcp https://www.zerodayinitiative.com/advisories/ZDI-26-245
https://pwned.coffee/i/aws-mcp-has-a-command-injection-remote-code-execution-vu-cve-2026-5059

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee