This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — AWS published two Important security bulletins on 4 September 2026 for open-source MCP servers used by AI coding tools. CVE-2026-85654 affects awslabs.dynamodb-mcp-server versions 2.0.10 through 2.1.5; AWS fixed it in 2.1.6. CVE-2026-85787 affects awslabs.postgres-mcp-server versions before 1.1.7; AWS identifies 1.1.7 as the corrected boundary and recommends the latest release. The vendor advisories do not report active exploitation.
A DATA MODEL CROSSED INTO HOST EXECUTION — The DynamoDB server reads dynamodb_data_model.json and can generate an AWS CDK application. AWS says crafted table, index, or attribute names could exploit incomplete neutralization in that template path and execute arbitrary code on the host that deploys the generated application. The hostile value is not described as code at intake; it becomes code because the generator inserts it into an executable artifact.
READ-ONLY WAS AN APPLICATION PROMISE — The Postgres MCP server used a blocklist to reject SQL that appeared to mutate data when write queries were disabled. AWS says an incomplete list of disallowed inputs could let an unauthenticated actor place crafted SQL into content that an authenticated user later submits, modifying data beyond the intended read-only scope. Current project guidance explicitly calls the blocklist best-effort defense in depth, not a security boundary.
THE HUMAN CAN BECOME THE MISSING EXECUTION STEP — These issues have different mechanics, but both depend on a trusted workflow carrying attacker-shaped content across a stronger boundary: deployment in one case and an authenticated MCP interaction in the other. Editorial inference: a confirmation click, authenticated user, or agent-approved tool call does not make upstream content trustworthy. Security review must follow the data into the generated code, database role, shell, or deployment host that ultimately interprets it.
WHAT TO CHECK — Upgrade dynamodb-mcp-server to 2.1.6 or later and postgres-mcp-server to 1.1.7 or later, preferably the current releases; patch forks and derivative code too. Before running the DynamoDB CDK generator, review dynamodb_data_model.json for unexpected table, index, and attribute names, and inspect previously generated CDK artifacts when their model provenance is uncertain. Run the Postgres server under a dedicated minimal-privilege role: never superuser, rds_superuser, or the cluster master; for read-only use, limit it to CONNECT, USAGE, and SELECT and force read-only transactions at the role level. Inventory MCP configurations, package pins, generated infrastructure code, database credentials, and every place external content can enter an authenticated agent session.