What happened
CWE-863/CWE-1025 authorization bypass. The policy compares operation names after a normalization that fails on names with consecutive capital letters, so an agent can reach AWS API calls the operator explicitly denied or marked as requiring approval. CVSS 7.8 (3.1) / 8.5 (4.0).
Why it matters
This is a guardrail failure in the exact place an AI agent's AWS permissions should be bounded. A normalization gap lets an agent slip past the deny/elicitation control and act across AWS services.
Attack vector
Incorrect normalization of operation names in the custom security-policy enforcement lets an actor invoke AWS API operations whose names contain consecutive capital letters, circumventing deny or elicitation-required rules.
Affected systems
awslabs aws-api-mcp-server 0.2.13 to <1.5.1 (PyPI awslabs.aws-api-mcp-server)
Mitigation
Upgrade to aws-api-mcp-server 1.5.1 (AWS security bulletin 2026-176-aws; GitHub GHSA-4wq9-grf3-qg2p).