{"action":"Upgrade awslabs-aws-api-mcp-server to 1.3.47 or later.","affected":[{"fixed":"1.3.47","introduced":"0.2.13"}],"component":"awslabs-aws-api-mcp-server","cve_ids":["CVE-2026-16584"],"ecosystem":"PyPI","epss":0.00227,"exploited":false,"fixed_versions":["1.3.47"],"ghsa_id":"GHSA-29w2-fq35-v728","id":"tcs_01M5KH5ZA1QBC2PSR952W84XAT","modified_at":"2026-08-04T14:30:24.402881095Z","published_at":"2026-08-04T11:34:43.528669Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3549","https://github.com/awslabs/mcp/security/advisories/GHSA-29w2-fq35-v728","https://nvd.nist.gov/vuln/detail/CVE-2026-16584","https://github.com/awslabs/mcp/pull/4315","https://github.com/awslabs/mcp/commit/ab1bbebc097d674c1cdd4bd75a8f313be18473bf","https://aws.amazon.com/security/security-bulletins/2026-063-aws","https://github.com/awslabs/mcp","https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.47","https://pypi.org/project/awslabs-aws-api-mcp-server","https://github.com/advisories/GHSA-29w2-fq35-v728"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3549","url":"https://osv.dev/vulnerability/PYSEC-2026-3549"}],"summary":"AWS API MCP Server Security Policy Bypass via Startup Initialization Failure"}