MediumVulnerability

GHSA-2cpp-j2fc-qhp7: AWS API MCP File Access Restriction Bypass

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-4270GHSA-2cpp-j2fc-qhp7
Published: March 17, 2026
Record updated: October 9, 2026

Affected: awslabs.aws-api-mcp-server >= 0.2.14, < 1.3.9
Fixed in: 1.3.9
released February 12, 2026, 33 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.1%

Summary

The AWS API MCP Server, an open source Model Context Protocol server that lets AI assistants run AWS CLI commands, contains an Improper Protection of Alternate Path flaw in its no-access and workdir file access features. Versions >= 0.2.14 and < 1.3.9, on all platforms, can bypass the intended file restriction and expose arbitrary local file contents in the MCP client application context.

Mitigation

Upgrade to version 1.3.9.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.1%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Disclosure date: March 17, 2026

Affected

Packages: awslabs.aws-api-mcp-server@>= 0.2.14, < 1.3.9 (fixed: 1.3.9)
Vendors: Amazon

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Plugin
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-2cpp-j2fc-qhp7

First tracked: March 17, 2026 at 04:55 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Topics

Model Context Protocol

Summary

Mitigation

Topics

Related items