What happened
AWS published a security bulletin and CVE-2026-16584 (CVSS 7.0, July 23 2026) describing a fail-open condition in its official API MCP Server: when the security policy layer fails to initialize, the server continues running without any per-request policy enforcement, silently removing the guardrails meant to restrict an AI agent's allowed AWS operations.
Why it matters
This is a fail-open design flaw in the officially maintained AWS MCP server that agentic AI systems use to interact with AWS — an agent or attacker leveraging this could execute AWS operations explicitly intended to be blocked by the deployer's configured guardrails, undermining the primary safety control organizations rely on to constrain what an LLM agent can do against production cloud infrastructure.
Attack vector
If the security-policy enforcement data fails to initialize at server startup, the policy check is silently skipped for the entire lifetime of the process — allowing an LLM agent (or anyone driving it) to execute AWS API operations that the configured policy was meant to deny or gate, while underlying IAM permissions remain in full effect and unaffected.
Affected systems
AWS API MCP Server (awslabs.aws-api-mcp-server) 0.2.13 – 1.3.46
Mitigation
Upgrade to AWS API MCP Server version 1.3.47 or later; verify fail-closed behavior on startup and confirm the security policy is actually being enforced post-upgrade.