CVE-2026-85654 - Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
Amazon DynamoDB ยท 2026-10-21
Actions
Technical Details
| Affected Versions | >= 2.0.10, <= 2.1.5 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-85654 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update awslabs.dynamodb-mcp-server to version 2.1.6 to address CVE-2026-85654 and prevent arbitrary code execution via crafted data model files.
For Platform Teams
Deploy the patched awslabs.dynamodb-mcp-server version 2.1.6 to ensure secure interaction between AI coding assistants and DynamoDB, reducing the risk of code injection vulnerabilities.
For Executives
Implement the latest awslabs.dynamodb-mcp-server version 2.1.6 to mitigate the risk of code injection and protect your applications from potential security breaches.
Source
Related Amazon DynamoDB Updates
- Amazon DynamoDB global tables now support disassociating replicas (2026-10-20)
- Amazon DynamoDB Streams now supports timestamp-based stream processing (2026-10-15)
- Introducing filtered export from Amazon DynamoDB to Amazon S3 (2026-10-01)
- Amazon DynamoDB Accelerator (DAX) is now available in additional Regions (2026-10-01)
- Amazon DynamoDB introduces filtered export to Amazon S3 (2026-10-01)