Cyber Resilience

CVE-2026-5058

CriticalRCE

Published: 11 April 2026

Published
11 April 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score v3 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0183 76.1th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-5058 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-5058 is a command injection vulnerability in aws-mcp-server that permits remote code execution. The flaw lies in the handling of the allowed commands list, where a user-supplied string is used to execute a system call without proper validation, enabling an attacker to run arbitrary commands. The issue affects installations of aws-mcp-server and carries a CVSS score of 9.8 under CWE-78.

Remote attackers require no authentication to exploit the vulnerability and can achieve code execution in the context of the MCP server. The issue was originally reported as ZDI-CAN-27968.

The Zero Day Initiative advisory ZDI-26-246 provides further details on the vulnerability. The associated EPSS scores remain low, with a current value of 0.0143 and a peak of 0.0171.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the allowed commands…

more

list. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the MCP server. Was ZDI-CAN-27968.

CWE(s)

AI Security AnalysisAI

AI Category
AI Agent Protocols and Integrations
Risk Domain
Protocol-Specific Risks
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: mcp

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Unauthenticated remote command injection RCE in public-facing aws-mcp-server directly enables T1190 exploitation and arbitrary command execution via T1059.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-23882Shared CWE-78
CVE-2026-30635Shared CWE-78
CVE-2026-34935Shared CWE-78
CVE-2026-6942Shared CWE-78
CVE-2026-28470Shared CWE-78
CVE-2025-69269Shared CWE-78
CVE-2025-24971Shared CWE-78
CVE-2026-22553Shared CWE-78
CVE-2026-7593Shared CWE-78
CVE-2026-22901Shared CWE-78

Affected Assets

Zerodayinitiative
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user-supplied strings before they are used in system calls, blocking the command-injection flaw in the allowed-commands handler.

prevent

Enforces restriction of the allowed-commands list to only the minimal set of approved executables, reducing the attack surface that the missing validation exposes.

prevent

Limits the privileges under which the MCP server process runs, constraining the impact of any code successfully injected via the unauthenticated flaw.

References