CVE-2026-5058: aws-mcp-server Critical Command Injection — CVSS 9.8, Pre-Auth RCE via Allowed Commands List

TheHackerWire·high signal

A critical command injection vulnerability in aws-mcp-server (CVSS 9.8) allows unauthenticated remote attackers to achieve arbitrary code execution by injecting malicious commands into the allowed commands list string before it reaches a system call. No authentication required — any network-accessible instance is exploitable. This is the second critical MCP server CVE in a week, after the OpenAPI library SSRF. If you run aws-mcp-server, update immediately and audit command validation logic.