Upgrade DynamoDB MCP Server to Stop Code Execution on Hosts

AWS published a security bulletin on September 4, 2026, warning that a code injection flaw in its open-source DynamoDB MCP server could let attackers execute commands on deployment hosts. The issue, tracked as CVE-2026-85654, affects how the tool processes data model files for AI coding assistants.

An attacker with the right context can craft specific table, index, or attribute names within a data model file. When the CDK generator component processes these names, it fails to neutralize special elements properly. This allows the execution of arbitrary code on the machine that deploys the resulting application infrastructure.

Context and Background

The awslabs.dynamodb-mcp-server is an open-source project designed to let AI coding assistants interact with Amazon DynamoDB services. It handles tasks such as table design, data modeling, and the generation of Cloud Development Kit infrastructure code. Because it bridges AI tools with cloud infrastructure, flaws in its processing logic can have direct impacts on the underlying host systems.

AWS classifies this bulletin as important and requiring attention. The company identified the vulnerability through a coordinated disclosure process. Jaimen Bell collaborated with AWS on this issue, helping to identify the risk and work toward a resolution for users of the open-source server.

Who Is Affected

The vulnerability impacts users of the awslabs.dynamodb-mcp-server versions 2.0.10 through 2.1.5. Any organization or developer using these specific versions to generate CDK infrastructure from DynamoDB data models is exposed. This includes small businesses and teams relying on AI assistants to manage their database schemas and cloud resources.

Users who have forked or created derivative code from the affected versions must also apply the fixes. Simply upgrading the main package may not patch custom forks unless the new code is manually integrated. AWS recommends ensuring all derivative code incorporates the updates found in the latest release.

What to watch

AWS released version 2.1.6 to address CVE-2026-85654. The company advises all users to upgrade to this latest version immediately. This update contains the necessary fixes to neutralize the special elements in the template engine that previously allowed code injection.

For users who cannot upgrade right away, AWS suggests manual review of the dynamodb_data_model.json file. Teams should look for unexpected or unintended table, index, or attribute names before running the CDK generator. Avoid using data model files from untrusted or unverified sources to reduce the risk of exploitation during this interim period.

What made it possible

This incident illustrates the risks of template injection in infrastructure-as-code tools. When software generates code from user-supplied data, it must strictly separate data from executable instructions. If special characters or syntax elements are not properly escaped, they can be interpreted as commands. This weakness typically serves the initial access or execution stage of an intrusion, allowing an attacker to run code on the host system that processes the template.

What to do and how to stay safe: AWS

• Update the awslabs.dynamodb-mcp-server to version 2.1.6 or later to apply the official fix.
• Review any forked or derivative code to ensure it includes the security patches from the latest release.
• Manually inspect dynamodb_data_model.json files for suspicious table, index, or attribute names if you cannot upgrade immediately.
• Avoid importing or using data model files from sources that are not trusted or verified.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85654?

It is a code injection vulnerability in the CDK generator component of the awslabs.dynamodb-mcp-server that allows arbitrary code execution on deployment hosts.

Which versions are affected?

Versions 2.0.10 through 2.1.5 of the awslabs.dynamodb-mcp-server are impacted by this security issue.

Is there a fix available?

Yes, AWS released version 2.1.6 to address the vulnerability, and users are advised to upgrade to this version.