{"data":{"id":"06e7d907-eb9f-424f-9747-4cff2960575e","title":"GHSA-2cpp-j2fc-qhp7: AWS API MCP File Access Restriction Bypass","summary":"The AWS API MCP Server, an open source Model Context Protocol server that lets AI assistants run AWS CLI commands, contains an Improper Protection of Alternate Path flaw in its no-access and workdir file access features. Versions >= 0.2.14 and < 1.3.9, on all platforms, can bypass the intended file restriction and expose arbitrary local file contents in the MCP client application context.","solution":"Upgrade to version 1.3.9.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2cpp-j2fc-qhp7","publishedAt":"2026-03-17T20:33:15.000Z","cveId":"CVE-2026-4270","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["awslabs.aws-api-mcp-server@>= 0.2.14, < 1.3.9 (fixed: 1.3.9)"],"affectedPackageNames":["awslabs-aws-api-mcp-server"],"affectedPackageRefs":["pypi:awslabs-aws-api-mcp-server"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS API MCP Server","Model Context Protocol (MCP)","AWS CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00136,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-2cpp-j2fc-qhp7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-17T20:33:15.000Z","fixReleasedAt":"2026-02-12T09:26:58.990Z","daysToFix":-33,"fixCheckedAt":"2026-10-29T21:39:51.612Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"awslabs.aws-api-mcp-server","fixedVersion":"1.3.9","matchedVersion":"1.3.9","fixReleasedAt":"2026-02-12T09:26:58.990Z","daysToFix":-33,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:51.464Z"}]}}