---
title: AWS API MCP Server's deny and confirmation rules could be skipped for operations with consecutive capital letters; update to 1.5.1 | ctxsec
url: https://ctxsec.com/items/aws-api-mcp-server-cve-2026-125271-denylist-elicitlist-bypass-consecutive-capitals-1-5-1
description: "AWS says versions 0.2.13 up to 1.5.0 of its open-source AWS API MCP Server normalized operation names incorrectly before checking them against the operator's custom security policy. Operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry, so an AI assistant could run calls the policy was meant to block or require confirmation for, such as creating a federated identity provider, deactivating an MFA device or deleting database clusters. CVE-2026-125271 is rated High and fixed in 1.5.1."
status: "official (AWS Security Bulletin 2026-176-AWS and GHSA-4wq9-grf3-qg2p, Nov 10, 2026)"
published: 2026-11-11
---

> AWS says versions 0.2.13 up to 1.5.0 of its open-source AWS API MCP Server normalized operation names incorrectly before checking them against the operator's custom security policy. Operations whose names contain consecutive capital letters never matched a correctly written denyList or elicitList entry, so an AI assistant could run calls the policy was meant to block or require confirmation for, such as creating a federated identity provider, deactivating an MFA device or deleting database clusters. CVE-2026-125271 is rated High and fixed in 1.5.1.

[← Context & Harness Attacks](/context) · [markdown](/items/aws-api-mcp-server-cve-2026-125271-denylist-elicitlist-bypass-consecutive-capitals-1-5-1.md)

official (AWS Security Bulletin 2026-176-AWS and GHSA-4wq9-grf3-qg2p, Nov 10, 2026)

2026-11-11 3:36 PM ET

### AWS API MCP Server's deny and confirmation rules could be skipped for operations with consecutive capital letters; update to 1.5.1

- **Who is affected:** locally run servers with a custom security policy that lists affected operations. AWS says the remote AWS API MCP Server offering and the READ_OPERATIONS_ONLY and REQUIRE_MUTATION_CONSENT settings are not affected.
- **Do:** upgrade `awslabs.aws-api-mcp-server` to 1.5.1 or later; there is no workaround. Patch forks too.
- **Check:** CloudTrail for operations on your denyList made by the IAM identity your MCP server uses.
- **Lesson:** an MCP server's own allow/deny list is a convenience, not a boundary; scope the IAM role so denied actions fail at AWS as well.

Sources: [AWS Security Bulletin 2026-176-AWS: CVE-2026-125271, AWS API MCP Server security policy bypass](https://aws.amazon.com/security/security-bulletins/2026-176-aws/) · [GitHub advisory GHSA-4wq9-grf3-qg2p (awslabs/mcp)](https://github.com/awslabs/mcp/security/advisories/GHSA-4wq9-grf3-qg2p)