CVE-2026-5059

CRITICAL

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-5059. PoCs published by adminlove520, venom203020.

AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2026-5059, explaining the root cause (shell=True in subprocess.run) and the incomplete validation in security.py. It contrasts the vulnerable version with the patched version (v1.7.0), which uses shell=False and OS-level sandboxing.

Description

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.

Exploits (2)

github WRITEUP 4 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2026/CVE-2026-5059

The repository provides a detailed technical analysis of CVE-2026-5059, explaining the root cause (shell=True in subprocess.run) and the incomplete validation in security.py. It contrasts the vulnerable version with the patched version (v1.7.0), which uses shell=False and OS-level sandboxing.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Unspecified software (likely a CLI tool using subprocess)
No auth needed
Prerequisites: Access to execute commands in the vulnerable software
devstral-2 · analyzed May 09, 2026 Full analysis →
nomisec WRITEUP
by venom203020 · poc
https://github.com/venom203020/CVE-2026-5059-poc

This repository provides a detailed technical analysis of CVE-2026-5059, explaining the root cause (shell=True in subprocess.run) and the incomplete validation in the vulnerable version, contrasted with the fixed version's use of shell=False and OS-level sandboxing.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Custom tool using subprocess with shell=True (version prior to v1.7.0)
No auth needed
Prerequisites: Access to execute commands in the vulnerable tool
devstral-2 · analyzed Apr 16, 2026 Full analysis →

References (1)

Core 1
Core References
X_Research Advisory x_research-advisory
ZDI-26-245
https://www.zerodayinitiative.com/advisories/ZDI-26-245/

Scores

CVSS v3 9.8
EPSS 0.0121
EPSS Percentile 79.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
aws-mcp-server/aws-mcp-server 1.3.0
pypi/aws-mcp 0PyPI
Published Apr 11, 2026
Tracked Since Apr 11, 2026