CVE-2026-5059

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27969.

• CWE-78

• https://www.zerodayinitiative.com/advisories/ZDI-26-245/

Published

Apr 11, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5057ATEN Unizon RpcProvider Missing Authentication Denial-of-Ser…7.5
• CVE-2026-50570Fission is an open-source, Kubernetes-native serverless fram…8.5
• CVE-2026-50573pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnp…8.1
• CVE-2026-50574yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-5058aws-mcp-server Command Injection Remote Code Execution Vulne…9.8
• CVE-2026-50589In OpenStack Ironic 32 before 37.0.0, an unauthenticated mal…7.5
• CVE-2026-50590In Mimecast Incydr before 2.6.0, arbitrary file access can o…4.5
• CVE-2026-50591In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can o…5.4
• CVE-2026-50592In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is …6.4
• CVE-2026-50593Graphite before 1.3.15 has an integer underflow and resultan…7.3
• CVE-2026-5060The MasterStudy LMS WordPress Plugin – for Online Courses an…6.5
• CVE-2026-5061The consul-template library before version 0.42.0 is vulnera…4.7