AWS's own CNA publishes five CVE records against four awslabs MCP servers in a week, led by a critical, already-fixed command injection

Amazon's own CVE numbering authority published five CVE records between 2026-09-04 and 2026-09-10 against four servers in the awslabs MCP collection. The worst is CVE-2026-87911, an OS command injection in postgres-mcp-server rated critical at CVSS 3.1 9.6 and CVSS 4.0 9.0, both scored by AMZN. The server's read-only enforcement did not block every SQL verb capable of system-level operations, and a crafted COPY ... TO PROGRAM statement, run through a database role holding elevated privileges, let an actor execute operating system commands on the host of a self-managed PostgreSQL server. The fix shipped in 1.1.7, uploaded to PyPI on 2026-06-25, eleven weeks before the record published.

A second postgres-mcp-server record, CVE-2026-85787, covers a related gap in the same SQL validation component: an incomplete list of disallowed inputs that could let an unauthenticated actor modify data beyond the server's read-only scope. AMZN scored it medium under CVSS 3.1 at 6.5 but high under CVSS 4.0 at 7.1, a tier disagreement between the two scoring versions from the same assigner. Both postgres-mcp-server records are closed by the same 1.1.7 release.

The remaining three records each hit a different package. CVE-2026-85654 (high, 7.8) is a code injection in dynamodb-mcp-server's CDK generator: a Jinja2 template renders with autoescape disabled, so table, index, and attribute names from a data model file can inject code into the generated CDK stack; fixed in 2.1.6, uploaded 2026-08-14. CVE-2026-85788 (medium, 5.5) is a read-only bypass in mysql-mcp-server, whose enforcement regex expected literal whitespace between SQL keywords; MySQL treats comment sequences as whitespace too, so inline comments could smuggle mutating statements past the check. It was fixed in 1.0.23, uploaded 2026-07-02. CVE-2026-87913 (medium, 5.9) affects the AWS Security Agent MCP server, which validated its scan-output S3 bucket by existence rather than ownership, so a third party could pre-register the predictable bucket name in their own account and collect a scanned workspace's source archive, credentials and infrastructure state included. It was fixed in 0.2.0, uploaded 2026-08-26.

Every fix in the batch shipped before its own CVE record published. None of the four affected packages are cataloged here as entities; the site's existing yawlabs-postgres-mcp entry is an unrelated community project that does not share code with awslabs.postgres-mcp-server.