AWS API MCP security advisory: custom denyList bypass

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsAWS API MCP ignored a custom denyList for alternate command name spellings: AWS API MCP Server versions >=0.2.13 and <1.5.1 incorrectly normalized operation names with consecutive capitals when enforcing custom denyList or elicitList rules; the advisory marks 1.5.1 patched.

  Affected versions, patched versions and Summary paragraphs of GHSA-4wq9-grf3-qg2p

• supportsAWS API MCP ignored a custom denyList for alternate command name spellings: The AWS API MCP advisory documents a bypass of custom denyList operation names, patched in 1.5.1.

  GHSA-4wq9-grf3-qg2p: Description and Patched versions

• supportsAWS API MCP ignored a custom denyList for alternate command name spellings: The flaw did not itself grant new AWS IAM privileges or bypass every independent approval and read-only restriction.

  GHSA-4wq9-grf3-qg2p: Impact and preconditions