CVE-2026-4270CWE-424

AWS API MCP File Access Restriction Bypass

Medium · published March 16, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context.

To remediate this issue, users should upgrade to version 1.3.9.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00188 · 8.0th percentile
Weakness
CWE-424 · Improper Protection of Alternate Path
Published
2026-03-16T16:07Z
EPSS history
Timeline
  • 16 MAR 16:07Z
    AWS API MCP File Access Restriction Bypass
    cvelistv5