Is CVE-2026-115845 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-115845?

CVE-2026-115845 has a CVSS v3 severity of MEDIUM (6.4).

Back

CVE-2026-115845

Description

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.