AWS patches security policy bypass in AWS API MCP Server allowing unauthorized tool calls
What happened.Amazon Web Services published security bulletin 2026-176-AWS detailing a policy bypass vulnerability in its open-source Model Context Protocol server.
Why it matters.Model Context Protocol servers give artificial intelligence assistants programmatic access to cloud APIs. When case normalization errors let API calls bypass deny lists, autonomous agents execute destructive actions without required approvals. Cloud engineers must upgrade AWS API MCP servers to version 1.5.1 immediately.