CVE-2026-16584: aws aws-api-mcp-server Non-exit on Failed Initialization

Vulnerability summary

CVE-2026-16584 is a high (CVSS 7.3) Non-exit on Failed Initialization vulnerability in aws aws-api-mcp-server. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Timeline

1. 23-07-2026
   PublishedVulnerability first disclosed.
2. 23-07-2026
   Last modifiedVulnerability information updated.

Description

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected. To remediate this issue, users should upgrade to version 1.3.47.

• CWE-455Non-exit on Failed InitializationThe product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.