AWS vulnerabilities
We track 118 vulnerabilities in AWS products across 60+ products. 118 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest AWS vulnerabilities
- 7.8 High severity
projen: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via she
- 7.1 High severity
projen: Relative Path Traversal
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running pr
- 9.9 Critical severity
Amazon SSM Agent: Server-Side Request Forgery
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenti
- 9.6 Critical severity
AWS Labs postgres MCP Server: Improper Neutralization of Special Elements used in an OS Command
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL
- 8.7 High severity
Amazon OpenSearch Service: Improper Neutralization of Input During Web Page Generation
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a c
- 8.7 High severity
aws-efs-csi-driver: Unverified Ownership
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an E
- 7.8 High severity
aws-fpga: Creation of Temporary File in Directory with Insecure Permissions
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shel
- 8.0 High severity
@amazon-codecatalyst/blueprints.blueprint: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execu
- 7.2 High severity
sagemaker-python-sdk: Cleartext Storage of Sensitive Information
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline
- 7.1 High severity
diagram-as-code: Relative Path Traversal
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal seq
- 8.7 High severity
Amazon OpenSearch Service: Improper Neutralization of Input During Web Page Generation
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser se
- 9.9 Critical severity
Athena Federated Query Neptune Connector: Improper Neutralization of Directives in Dynamically Evaluated Code
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.
- 8.8 High severity
Amazon OpenSearch Service: Improperly Controlled Modification of Object Prototype Attributes
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a
- 7.5 High severity
OpenSearch Dashboards: Improper Validation of Specified Quantity in Input
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
- 8.8 High severity
Opensearch: Protection Mechanism Failure
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query end
- 8.1 High severity
OpenSearch: Undefined Behavior for Input to API
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index p
- 8.1 High severity
Opensearch: Server-Side Request Forgery
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel sou
- 8.1 High severity
strands-agents-tools: Authorization Bypass Through User-Controlled Key
Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influenci
- 8.8 High severity
aws-transform-mcp-server: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the sa
- 8.1 High severity
Amazon Bedrock AgentCore harness: Improper Validation of Specified Type of Input
Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this
- 7.4 High severity
Strands Agents Tools: Incorrect Authorization
Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastruc
- 7.3 High severity
AWS Ops Wheel: Improper Neutralization of Input During Web Page Generation
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url valu
- 8.8 High severity
Amplify Codegen UI: Improper Control of Generation of Code
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via cra
- 7.5 High severity
aws-smithy-json: Uncontrolled Recursion
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service (
- 7.3 High severity
bedrock-agentcore 1.18.1: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name
- 7.5 High severity
aws-smithy-http-server: Allocation of Resources Without Limits or Throttling
Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial re
- 7.0 High severity
aws-api-mcp-server: Non-exit on Failed Initialization
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of th
- 7.5 High severity
aws-sdk-rust: Uncontrolled Recursion
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserialize
- 7.8 High severity
jsii: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users sho
- 7.3 High severity
awslabs.healthlake-mcp-server: Server-Side Request Forgery
AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlak
- 8.1 High severity
MCP Gateway & Registry: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that
- 8.8 High severity
AWS Advanced JDBC Wrapper: Deserialization of Untrusted Data
Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that
- 7.3 High severity
AWS CDK: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host ru
- 9.8 Critical severity
AWS Application Load Balancer: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only
- 9.8 Critical severity
Amazon CloudFront: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial bo
- 7.3 High severity
bedrock-agentcore: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via craf
- 8.8 High severity
aws-c-http: Double Free
Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code executi
- 7.3 High severity
AWS Cloud Development Kit library: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to ex
- 9.0 Critical severity
AgentCore CLI: Improper Control of Generation of Code
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role a
- 8.0 High severity
AWS Advanced Go Wrapper: Untrusted Search Path
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, vi