CVE-2026-5059

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.

• CWE-78

• https://www.zerodayinitiative.com/advisories/ZDI-26-245/

Published

Apr 11, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50575BetterDesk is a remote desktop management solution. BetterDe…7.7
• CVE-2026-50576ePA 3.x Integration implements the authorization workflow an…6.8
• CVE-2026-50577ePA 3.x Integration implements the authorization workflow an…7.4
• CVE-2026-50578ePA 3.x Integration implements the authorization workflow an…7.5
• CVE-2026-5058aws-mcp-server Command Injection Remote Code Execution Vulne…9.8
• CVE-2026-50589In OpenStack Ironic 32 before 37.0.0, an unauthenticated mal…7.5
• CVE-2026-50590In Mimecast Incydr before 2.6.0, arbitrary file access can o…4.5
• CVE-2026-50591In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can o…5.4
• CVE-2026-50592In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is …6.4
• CVE-2026-50593Graphite before 1.3.15 has an integer underflow and resultan…7.3
• CVE-2026-5060The MasterStudy LMS WordPress Plugin – for Online Courses an…6.5
• CVE-2026-50601A security vulnerability has been identified in the Planet9 …6.6