CVE-2026-16584: Improper handling of an initialization failure in AWS API MCP Server from 0

What it is

CVE-2026-16584 carries a CVSS 4.0 base score of 7.3 (HIGH), published 2026-07-23, status Awaiting Analysis. The existing summary describes the flaw accurately; what it omits is the severity vector, which changes how a reader should prioritize it.

How the score reads

The vector is CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The parts that matter for triage:

• AV:L (Local) — this is not remotely reachable over a network. Exploitation happens through local access to the process/host running the MCP server.
• AT:P (Attack Requirements: Present) — it depends on a specific condition occurring: the security-policy enforcement data must fail to initialize at startup. This is not attacker-triggerable on demand from the vector's framing; it hinges on that init failure happening.
• UI:P (Passive user interaction) — some user action is in the loop.
• PR:N — no privileges required once the condition holds.
• VC:H / VI:H / VA:H — full confidentiality, integrity, and availability impact on the vulnerable component; but SC:N / SI:N / SA:N, so no scored impact beyond the component itself.

The high impact triad combined with a local vector and a conditional trigger is why this lands at 7.3 rather than critical: the damage is severe but the path is narrow.

What to do

Upgrade to 1.3.47 (awslabs.aws-api-mcp-server), the only listed remediation. The fixed release is on PyPI:

https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.47/

Two authoritative references the summary does not list, worth reading before you act:

• AWS security bulletin: https://aws.amazon.com/security/security-bulletins/2026-063-aws/
• GitHub advisory: https://github.com/awslabs/mcp/security/advisories/GHSA-29w2-fq35-v728

Caveats

Status is Awaiting Analysis — NVD has not finished its own scoring/enrichment, so weaknesses and vector may still shift. IAM permissions on the configured credentials remain in effect regardless, so a tightly-scoped IAM role limits blast radius even on an unpatched server; the bypass only defeats the MCP-layer allow/deny policy, not IAM itself.