AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AWSAWS-2026-063

AWS API MCP Server Security Policy Bypass via Startup Failure

AWS

CVE-2026-16584 · Published Oct 19, 2026

High7.0
No fix yet
AWS advisory

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 7Severity: Unrated to High
Details and references
Severity from
NVD

More AWS advisories

All AWS
High 7.5Oct 19Allocation of resources without limits in the default aws-smithy-http-server serve() path...CVE-2026-16756no fix yetMedium 6.5Oct 19Credential disclosure in Strands Agents Tools elasticsearch_memory toolCVE-2026-15746no fix yetMedium 6.5Oct 19Issues with s2n-tls: an open-source implementation of the TLS/SSL protocolsCVE-2026-16317no fix yetMedium 5.7Oct 19Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKCVE-2026-15737no fix yetHigh 7.5Oct 19Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows...CVE-2026-18140no fix yetHigh 7.8Oct 19OS command injection in jsii-diff in AWS jsiiCVE-2026-15895no fix yet