Security: awslabs/mcp
Security
.github/SECURITY
Reporting a Vulnerability If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. !!! IMPORTANT !!! Please do not create a GitHub issue, pull request, or other public annoucements.
-
Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-serverGHSA-fph8-pg5w-78fv published
Sep 9, 2026 by scottschreckengaustCritical -
Missing S3 bucket ownership verification in the AWS Security Agent MCP serverGHSA-3jxw-vj8m-8x77 published
Sep 10, 2026 by arnewoutersModerate -
Incomplete list of disallowed inputs in awslabs mysql-mcp-server allows read-only mode to be circumvented via SQL inline commentsGHSA-x25m-ph3m-3r9q published
Sep 9, 2026 by scottschreckengaustModerate -
Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverGHSA-35jj-hwvm-792x published
Sep 8, 2026 by scottschreckengaustHigh -
An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverGHSA-pwr4-hmph-gqgc published
Sep 4, 2026 by scottschreckengaustModerate -
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP ServerGHSA-j694-4m5j-w8hc published
Aug 5, 2026 by scottschreckengaustModerate -
Improper limitation of a pathname in AWS Transform MCP ServerGHSA-66mr-jr63-2jgw published
Aug 5, 2026 by scottschreckengaustHigh -
Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-serverGHSA-6x7f-488g-75wm published
Jul 17, 2026 by scottschreckengaustModerate -
AWS HealthLake MCP Server SSRF via Unvalidated Pagination URLGHSA-c5vr-x62j-w6rw published
Jul 14, 2026 by scottschreckengaustHigh -
Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt InjectionGHSA-xwj6-8x5h-hjp6 published
Aug 3, 2026 by scottschreckengaustModerate
Learn more about advisories related to awslabs/mcp in the GitHub Advisory Database