CVE-2026-5058 is a command injection vulnerability in aws-mcp-server that permits remote attackers to execute arbitrary code without authentication. The root cause is insufficient validation of user input before executing system calls related to the allowed commands list. This vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. The vendor has not issued a patch or official remediation, and the advisory suggests restricting access to the product as the main mitigation.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the aws-mcp-server process, potentially leading to full system compromise. No authentication is required, increasing the risk of exploitation. The vulnerability affects confidentiality, integrity, and availability of the affected systems. There are no known exploits in the wild at the time of the advisory.

No official patch or fix is currently available as the vendor rejected the vulnerability report. The advisory recommends restricting interaction with the aws-mcp-server product to mitigate risk. Organizations should limit network exposure and access to the affected server until a vendor fix is released. Monitor vendor communications for updates on remediation.