CVE-2026-5058
Published: 11 April 2026
Summary
CVE-2026-5058 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-5058 is a command injection vulnerability in aws-mcp-server that permits remote code execution. The flaw lies in the handling of the allowed commands list, where a user-supplied string is used to execute a system call without proper validation, enabling an attacker to run arbitrary commands. The issue affects installations of aws-mcp-server and carries a CVSS score of 9.8 under CWE-78.
Remote attackers require no authentication to exploit the vulnerability and can achieve code execution in the context of the MCP server. The issue was originally reported as ZDI-CAN-27968.
The Zero Day Initiative advisory ZDI-26-246 provides further details on the vulnerability. The associated EPSS scores remain low, with a current value of 0.0143 and a peak of 0.0171.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21655
Vulnerability details
aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands…
more
list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27968.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection RCE in public-facing aws-mcp-server directly enables T1190 exploitation and arbitrary command execution via T1059.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied strings before they are used in system calls, blocking the command-injection flaw in the allowed-commands handler.
Enforces restriction of the allowed-commands list to only the minimal set of approved executables, reducing the attack surface that the missing validation exposes.
Limits the privileges under which the MCP server process runs, constraining the impact of any code successfully injected via the unauthenticated flaw.