An important security bulletin has been issued for AWS. The issue affects the open-source AWS API MCP Server, named awslabs.aws-api-mcp-server. This server allows AI assistants to execute AWS CLI commands. It features an optional security policy designed to deny or gate specific AWS operations. A vulnerability, CVE-2026-16584, has been identified in its startup process. If the server's security policy initialization fails, it continues to run without checking per-request policies. When fail-closed modes are not enabled in the security policy, unauthorized AWS API operations can be executed. These operations would have otherwise been denied or gated by the policy. Importantly, the underlying IAM permissions for the credentials remain active and are not altered by this vulnerability. The affected versions of the AWS API MCP Server are those greater than or equal to 0.2.13 and less than 1.3.47. Users are advised to consult the provided article for the most current and comprehensive details.