CVE-2026-4270

MEDIUM 5.5

AWS API MCP File Access Restriction Bypass

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

CWE	CWE-424
Vendor	aws
Product	aws api mcp server
Published	Mar 16, 2026
Last Updated	Mar 16, 2026

Stay Ahead of the Next One

Get instant alerts for aws aws api mcp server

Be the first to know when new medium vulnerabilities affecting aws aws api mcp server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

AWS / AWS API MCP Server

0.2.14 < 1.3.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

aws.amazon.com: https://aws.amazon.com/security/security-bulletins/2026-007-AWS/ pypi.org: https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.9/