AWS MCP Server Flaws Expose File Read and Remote Code Execution Risks

Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in aws-mcp-server. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the @= operator passed through the aws___call_aws tool, to read arbitrary files from the underlying host even when FileAccessMode=NO_ACCESS was enabled. AWS assigned CVE-2026-4270 to the file access restriction bypass and said the issue was fixed in aws-api-mcp-server version 1.3.9; the exposure affected the public endpoint aws-mcp.us-east-1.api.aws as well as self-hosted or forked deployments.

A separate flaw, tracked as CVE-2026-5058 and published by Trend Micro's Zero Day Initiative as ZDI-26-246, allows unauthenticated remote code execution in aws-mcp-server because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug CVSS 9.8 and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for CVE-2026-4269, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.