Recommended action window: Monitor and triage in normal cycle
NVD description
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
AWS MCP Server's run_script tool screened Python with a blocklist. A crafted script slipped past it and ran arbitrary code in the caller's session. CVE-2026-115845, fixed service-side. Blocklists around code exec leak. The sandbox is the real control. https://aws.amazon.com/security/security-bulletins/2026-149-aws/
Nueva vulnerabilidad CVE-2026-115845 (severidad: Alta) del fabricante AWS (Amazon Web Services).
AWS fixed a validator gap in the run_script tool of its managed AWS MCP Server (CVE-2026-115845). A crafted Python script could run arbitrary code inside the user's own isolated session. Fixed service-side, no action needed. The bigger lesson is in AWS's postgres and mysql MCP server bulletins: read-only mode is a best-effort blocklist, and crafted SQL got past it. The real boundary is the database role you hand the agent. Give MCP servers a least-privilege DB user, never superuser or master.