Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 156

Export CSV
CVE-2026-18428

SQL Query Validation Bypass in OpenSearch Direct Query

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch
CVE-2026-19311

Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws Github
Products
Opensearch Opensearch
CVE-2026-16756

Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-server 0.66.5 or later.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-smithy-http-server
CVE-2026-19111

Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Strands-agents-tools
CVE-2026-18953

Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Aws Transform Mcp Server Aws-transform-mcp-server
CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Documentdb Mcp Server Documentdb-mcp-server
CVE-2026-18733

Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Strands-agents-tools Strands Agents Tools
CVE-2026-18830

Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Amazon Bedrock Agentcore Harness
CVE-2026-18655

Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context. To remediate this issue, users should upgrade to version 2.0.24.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Amazon-mq-mcp-server
CVE-2026-18394

Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to version 0.8.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Strands Agents Tools
CVE-2026-18481

Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws Ops Wheel
CVE-2026-18245

Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Amplify Codegen Ui Amplify Codegen Ui
CVE-2026-18140

Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (process abort via stack exhaustion) via a single small HTTP request containing deeply nested JSON to a smithy-rs generated server. To remediate this issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Aws-smithy-json Aws-smithy-json
CVE-2026-16796

Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to the patched version 1.18.1.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Bedrock-agentcore Bedrock-agentcore 1.18.1
CVE-2026-16584

AWS API MCP Server Security Policy Bypass via Startup Failure

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected. To remediate this issue, users should upgrade to version 1.3.47.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-api-mcp-server
CVE-2026-16317

Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3 records must be application_data (0x17). The s2n-tls AEAD implementation hardcodes this value in the additional authenticated data rather than using the actual wire byte, so the outer content_type is not covered by the authentication tag. This enables selective suppression of application data. In HTTP pipelining scenarios, dropping a TLS record containing an HTTP request can cause request/response desynchronization, where subsequent responses are delivered to the wrong requests. In write-heavy workloads, a dropped record containing a write request can result in undetectable data loss when the client interprets a subsequent success response as confirmation of the dropped write. All TLS 1.3 connections are affected. Both TLS clients and servers are affected. TLS 1.2 and QUIC connections are not affected. We recommend you upgrade s2n-tls to version v1.7.6

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
S2n-tls
CVE-2026-15415

Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research. Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow_files input. To remediate this issue, users should upgrade to version 0.0.36 or later.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-healthomics-mcp-server
CVE-2026-12283

SQL injection in Amazon Athena Synapse connector

Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax. Improper neutralization of special elements used in an SQL command in the Synapse connector in Amazon aws-athena-query-federation v2022.20.1 through v2026.19.1 might allow an authenticated remote user to execute injected read-only SQL queries that return unintended data from the connected database via a crafted table name. To remediate this issue, users should upgrade to version v2026.21.1 or later.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-athena-query-federation
CVE-2026-15737

Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access. We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Bedrock-agentcore
CVE-2026-14471

Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position. To remediate this issue, users should upgrade to version 1.0.13 or later.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Mcp Gateway & Registry Mcp Gateway Registry