high severity · published 2026-10-27
A local user could run AWS operations with the server's configured AWS credentials by using an access token issued to another application by the same identity provider. The server accepted such tokens because it did not validate the token audience in OAuth authentication mode.
Fixed in: 1.6.0
CVE: CVE-2026-115413
Source: NVD
You are affected if the installed version is older than 1.6.0. Check the version you have and update to 1.6.0 or later. The fixed version is verified against a vendor or advisory source.
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 556 and your operating system.