AWS Fixes Critical Python Sandbox Vulnerability in AWS MCP Server

Amazon Web Services (AWS) has addressed a Python code validation vulnerability in AWS MCP Server that could allow an authenticated remote user to execute arbitrary code within their own isolated session environment.

The issue, tracked as CVE-2026-115845, affects the run_script tool's Python code validator. According to AWS, an incomplete list of disallowed inputs could allow a user to submit a specially crafted script that bypasses validation.

AWS published the security bulletin on October 23, 2026, and confirmed that the issue has been resolved on the service side. Because AWS MCP Server is a managed service hosted by AWS, the bulletin lists no affected customer-managed software versions.

AWS says no customer action is required. The company has also clarified that customers using run_script only to orchestrate AWS API calls through Python scripts do not need to apply a workaround.

What Is CVE-2026-115845?

AWS MCP Server provides AI agents with access to AWS through the Model Context Protocol (MCP). Its run_script tool allows Python scripts to run in a sandboxed environment as part of workflows that interact with AWS APIs.

The vulnerability resides in the tool's Python code validator. AWS describes the issue as incomplete validation because the validator did not account for every disallowed input.

A remote user who has authenticated to the service could potentially exploit this weakness by submitting a crafted script. If successful, the script could execute arbitrary code within that user's own isolated session environment.

The bulletin specifically describes execution within the user's isolated session. It does not state that the vulnerability allows access to other users' sessions, escape from the sandbox, or compromise of the underlying AWS service infrastructure.

AWS has not disclosed the complete list of disallowed inputs, a proof-of-concept exploit, or additional technical details about the validation bypass.

Which AWS Service Is Affected?

The bulletin identifies the issue in the Python code validator used by the run_script tool in AWS MCP Server.

AWS classifies the bulletin as Important, requires attention. This is the severity classification stated in the bulletin, not a numerical CVSS score.

The company has not published a list of affected software versions because customers do not manage the hosted service version directly.

Why Input Validation Matters in AI Agent Workflows

MCP enables AI applications and agents to interact with external tools and services through a defined protocol. In AWS MCP Server, the run_script tool supports Python-based orchestration of AWS API calls.

A code validator is intended to inspect submitted scripts and reject disallowed inputs before execution. If its restrictions are incomplete, carefully crafted input may pass checks that were intended to prevent unsafe code execution.

In this case, AWS identifies incomplete validation as the underlying weakness. The bulletin does not provide enough detail to determine which specific Python language constructs or validation rules were involved.

For organizations building AI agent workflows, the incident highlights the importance of validating code submitted to execution environments. However, the advisory does not establish that other MCP implementations or AI agent platforms share the same vulnerability.

AWS Confirms Service-Side Resolution

AWS states that the vulnerability has been addressed on the service side. Customers do not need to install a patch or upgrade a customer-managed version of AWS MCP Server.

The bulletin lists impacted versions as not applicable because the service is exclusively hosted and managed by AWS.

AWS also specifies that customers who use run_script only to execute Python scripts that make AWS API calls do not need to implement a workaround.

The bulletin does not describe a separate customer-facing mitigation, configuration change, or manual remediation procedure.

What Customers Should Know

• No customer patch is required: AWS has resolved the issue on the service side.

• No affected version range is listed: AWS MCP Server is a managed, exclusively hosted service.

• No workaround is required for the stated API-orchestration use case: AWS explicitly says customers using run_script only to make AWS API calls through Python scripts do not need one.

• Technical exploit details remain limited: AWS has not disclosed the precise validation bypass or a proof of concept in this bulletin.

Conclusion

AWS has resolved CVE-2026-115845, a Python code validation vulnerability in the run_script tool of AWS MCP Server. The flaw could allow an authenticated remote user to execute arbitrary code within their own isolated session environment by submitting a crafted script that bypasses incomplete validation.

The company confirms that the issue was addressed service-side and that customers do not need to take action. AWS also states that no workaround is required for customers using the tool only to run Python scripts that make AWS API calls.

The bulletin does not establish cross-session compromise, sandbox escape, or exploitation in the wild. It also does not disclose the precise validation bypass or a proof-of-concept exploit.