CVE-2026-85654 Overview
CVE-2026-85654 is a template injection vulnerability in the Amazon awslabs.dynamodb-mcp-server package prior to version 2.1.6. The flaw resides in the Cloud Development Kit (CDK) generator, which fails to neutralize special characters embedded in data model files. A context-dependent attacker can craft malicious table, index, or attribute names that execute arbitrary code on the host deploying the generated application. The weakness is classified as [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).
Critical Impact
Attackers who supply a crafted data model file can achieve arbitrary code execution on the host running cdk deploy, compromising build systems and AWS deployment pipelines.
Affected Products
- Amazon awslabs.dynamodb-mcp-server versions prior to 2.1.6
- Amazon Web Services Model Context Protocol (MCP) server for DynamoDB
- CDK-generated applications produced by the vulnerable generator
Discovery Timeline
- 2026-09-04 - CVE-2026-85654 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85654
Vulnerability Analysis
The awslabs.dynamodb-mcp-server package generates AWS CDK application code from user-supplied data model files. The CDK generator interpolates DynamoDB table names, index names, and attribute names directly into template strings without escaping template metacharacters. When a developer or automation pipeline deploys the resulting CDK application, the template engine evaluates the injected content as executable code on the deployment host.
The vulnerability is exploitable in workflows where the data model file originates from an untrusted source, including AI-agent-driven pipelines where a Model Context Protocol (MCP) client passes attacker-influenced schema definitions to the server. Successful exploitation yields code execution with the privileges of the CDK deployment process, which typically holds AWS credentials capable of provisioning cloud infrastructure.
Root Cause
The root cause is missing input sanitization in the CDK generator's template rendering path. Special elements permitted by the underlying template engine are passed through unmodified from the input model file, allowing evaluation of attacker-controlled expressions during template expansion.
Attack Vector
Exploitation requires local access to submit a malicious data model file and user action to execute the CDK deployment. Once the poisoned model is processed, the generator emits application code containing the injected payload, which runs the first time the developer or CI/CD system executes the generated deployment.
No verified public proof-of-concept code is available. Refer to the AWS Security Bulletin 2026-097 for vendor-supplied technical details.
Detection Methods for CVE-2026-85654
Indicators of Compromise
- Data model files containing template engine syntax such as {{, }}, ${, or backticks within DynamoDB table, index, or attribute names.
- Unexpected child processes spawned by cdk synth or cdk deploy invocations.
- Outbound network connections from build hosts to unknown endpoints during CDK code generation.
- Modifications to AWS credentials, environment variables, or IAM configuration during a CDK deployment run.
Detection Strategies
- Inspect generated CDK output for anomalous string literals or code fragments that do not match the source data model.
- Compare hashes of generated CDK stacks against a baseline produced from vetted input models.
- Enable command-line auditing on build agents to capture arguments passed to Python and Node.js processes during deployment.
Monitoring Recommendations
- Monitor CI/CD runners and developer workstations for process execution originating from awslabs.dynamodb-mcp-server and downstream cdk commands.
- Alert on any read of sensitive files (~/.aws/credentials, ~/.ssh/) by processes launched from CDK deployments.
- Track installed versions of the awslabs.dynamodb-mcp-server PyPI package across engineering environments.
How to Mitigate CVE-2026-85654
Immediate Actions Required
- Upgrade awslabs.dynamodb-mcp-server to version 2.1.6 or later on every host, container image, and MCP server deployment.
- Audit recent CDK deployments produced by the vulnerable generator and redeploy from clean inputs where necessary.
- Rotate AWS credentials that were accessible on hosts executing the vulnerable generator.
Patch Information
Amazon released the fix in version 2.1.6 of the awslabs.dynamodb-mcp-server package. Install the patched release from PyPI awslabs.dynamodb-mcp-server 2.1.6 and consult the AWS Security Bulletin 2026-097 for vendor guidance.
Workarounds
- Restrict the source of data model files to trusted authors and reject files from untrusted MCP clients until the patch is deployed.
- Validate table, index, and attribute names against an allowlist limited to alphanumeric characters and underscores before invoking the generator.
- Execute CDK generation and deployment inside ephemeral, network-restricted containers without persistent AWS credentials.
# Upgrade to the patched release
pip install --upgrade 'awslabs.dynamodb-mcp-server>=2.1.6'
# Verify installed version
pip show awslabs.dynamodb-mcp-server | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
