--- url: "https://www.xcademia.com/news/aws-fixes-critical-python-sandbox-vulnerability-in-aws-mcp-server" title: AWS Fixes Critical Python Sandbox Vulnerability in AWS MCP Server description: "AWS fixed CVE-2026-115845, a Python sandbox validation flaw in AWS MCP Server. No customer action is required." publishedAt: "2026-10-24T10:17:20.011+00:00" updatedAt: "2026-10-24T12:03:24.46413+00:00" type: news category: "cloud-security" source_name: AWS Security Bulletins source_url: "https://aws.amazon.com/security/security-bulletins/2026-149-aws/" tags: - "#Cybersecurity" - "#CloudSecurity" - "#AWS" - "#AWSSecurity" - "#MCP" - "#PythonSecurity" - "#AISecurity" - "#CVE2026115845" --- # AWS Fixes Critical Python Sandbox Vulnerability in AWS MCP Server > AWS has fixed CVE-2026-115845 in the Python sandbox validator of AWS MCP Server. The flaw could allow an authenticated remote user to execute arbitrary code within their own isolated session environment. Source: **AWS Security Bulletins** · 24 October 2026 **A**mazon Web Services (AWS) has addressed a Python code validation vulnerability in AWS MCP Server that could allow an authenticated remote user to execute arbitrary code within their own isolated session environment. The issue, tracked as **CVE-2026-115845**, affects the `run_script` tool's Python code validator. According to AWS, an incomplete list of disallowed inputs could allow a user to submit a specially crafted script that bypasses validation. AWS published the security bulletin on October 23, 2026, and confirmed that the issue has been resolved on the service side. Because AWS MCP Server is a managed service hosted by AWS, the bulletin lists no affected customer-managed software versions. **AWS says no customer action is required.** The company has also clarified that customers using `run_script` only to orchestrate AWS API calls through Python scripts do not need to apply a workaround. ## What Is CVE-2026-115845? AWS MCP Server provides AI agents with access to AWS through the Model Context Protocol (MCP). Its `run_script` tool allows Python scripts to run in a sandboxed environment as part of workflows that interact with AWS APIs. The vulnerability resides in the tool's Python code validator. AWS describes the issue as incomplete validation because the validator did not account for every disallowed input. A remote user who has authenticated to the service could potentially exploit this weakness by submitting a crafted script. If successful, the script could execute arbitrary code within that user's own isolated session environment. The bulletin specifically describes execution within the user's isolated session. It does not state that the vulnerability allows access to other users' sessions, escape from the sandbox, or compromise of the underlying AWS service infrastructure. AWS has not disclosed the complete list of disallowed inputs, a proof-of-concept exploit, or additional technical details about the validation bypass. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792836862369-info-1--237-.webp) ## Which AWS Service Is Affected? The bulletin identifies the issue in the Python code validator used by the `run_script` tool in AWS MCP Server. Detail AWS bulletin information Product AWS MCP Server Affected component Python code validator in `run_script` Vulnerability Incomplete validation of disallowed inputs CVE CVE-2026-115845 Attacker requirement Authenticated remote user Potential impact Arbitrary code execution within the user's own isolated session environment Affected versions Not applicable, as this is an exclusively AWS-hosted managed service Resolution Addressed service-side Customer action None required AWS classifies the bulletin as **Important, requires attention**. This is the severity classification stated in the bulletin, not a numerical CVSS score. The company has not published a list of affected software versions because customers do not manage the hosted service version directly. ## Why Input Validation Matters in AI Agent Workflows MCP enables AI applications and agents to interact with external tools and services through a defined protocol. In AWS MCP Server, the `run_script` tool supports Python-based orchestration of AWS API calls. A code validator is intended to inspect submitted scripts and reject disallowed inputs before execution. If its restrictions are incomplete, carefully crafted input may pass checks that were intended to prevent unsafe code execution. In this case, AWS identifies incomplete validation as the underlying weakness. The bulletin does not provide enough detail to determine which specific Python language constructs or validation rules were involved. For organizations building AI agent workflows, the incident highlights the importance of validating code submitted to execution environments. However, the advisory does not establish that other MCP implementations or AI agent platforms share the same vulnerability. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792836884975-info-2--219-.webp) ## AWS Confirms Service-Side Resolution AWS states that the vulnerability has been addressed on the service side. Customers do not need to install a patch or upgrade a customer-managed version of AWS MCP Server. The bulletin lists impacted versions as **not applicable** because the service is exclusively hosted and managed by AWS. AWS also specifies that customers who use `run_script` only to execute Python scripts that make AWS API calls do not need to implement a workaround. The bulletin does not describe a separate customer-facing mitigation, configuration change, or manual remediation procedure. ### What Customers Should Know - **No customer patch is required:** AWS has resolved the issue on the service side. - **No affected version range is listed:** AWS MCP Server is a managed, exclusively hosted service. - **No workaround is required for the stated API-orchestration use case:** AWS explicitly says customers using `run_script` only to make AWS API calls through Python scripts do not need one. - **Technical exploit details remain limited:** AWS has not disclosed the precise validation bypass or a proof of concept in this bulletin. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792836912509-info-3--202-.webp) ## Conclusion AWS has resolved CVE-2026-115845, a Python code validation vulnerability in the `run_script` tool of AWS MCP Server. The flaw could allow an authenticated remote user to execute arbitrary code within their own isolated session environment by submitting a crafted script that bypasses incomplete validation. The company confirms that the issue was addressed service-side and that customers do not need to take action. AWS also states that no workaround is required for customers using the tool only to run Python scripts that make AWS API calls. The bulletin does not establish cross-session compromise, sandbox escape, or exploitation in the wild. It also does not disclose the precise validation bypass or a proof-of-concept exploit. ## Original source https://aws.amazon.com/security/security-bulletins/2026-149-aws/ ## Tags `#Cybersecurity` · `#CloudSecurity` · `#AWS` · `#AWSSecurity` · `#MCP` · `#PythonSecurity` · `#AISecurity` · `#CVE2026115845` --- ## About this content This Markdown news article is the citation-grade twin of [AWS Fixes Critical Python Sandbox Vulnerability in AWS MCP Server](https://www.xcademia.com/news/aws-fixes-critical-python-sandbox-vulnerability-in-aws-mcp-server). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/aws-fixes-critical-python-sandbox-vulnerability-in-aws-mcp-server - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt