CVE-2026-4270

Description

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context.To remediate this issue, users should upgrade to version 1.3.9.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.014

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-4270 are fixed in Python-awslabs-aws-api-mcp-server 1.3.9	Windows
Vulnerabilities CVE-2026-4270 are fixed in Python-awslabs-aws-api-mcp-server for linux 1.3.9	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234