{"action":"Upgrade awslabs-aws-api-mcp-server to 1.3.47 or later.","affected":[{"fixed":"1.3.47","introduced":"0.2.13"}],"component":"awslabs-aws-api-mcp-server","cve_ids":["CVE-2026-16584"],"ecosystem":"PyPI","epss":0.00227,"exploited":false,"fixed_versions":["1.3.47"],"ghsa_id":"GHSA-29w2-fq35-v728","id":"tcs_01M5KESAMGN8CPGVRKTQWW3VKR","modified_at":"2026-08-04T14:41:05.889987689Z","published_at":"2026-07-24T22:33:19Z","references":["https://osv.dev/vulnerability/GHSA-29w2-fq35-v728","https://github.com/awslabs/mcp/security/advisories/GHSA-29w2-fq35-v728","https://nvd.nist.gov/vuln/detail/CVE-2026-16584","https://github.com/awslabs/mcp/pull/4315","https://github.com/awslabs/mcp/commit/ab1bbebc097d674c1cdd4bd75a8f313be18473bf","https://aws.amazon.com/security/security-bulletins/2026-063-aws","https://github.com/awslabs/mcp","https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.47"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-29w2-fq35-v728","url":"https://osv.dev/vulnerability/GHSA-29w2-fq35-v728"}],"summary":"AWS API MCP Server Security Policy Bypass via Startup Initialization Failure"}