AWS API MCP File Access Restriction Bypass
Priority LOW 29CWE-424Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed AWS API MCP Server (AWS): 1.3.9awslabs.aws-api-mcp-server (PyPI): 1.3.9+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | AWS API MCP Server | 0.2.14 to before 1.3.9 | 1.3.9 | Patch available | CNA |
| — | awslabs.aws-api-mcp-server (PyPI) | 0.2.14 to before 1.3.9 | 1.3.9 | Patch available | GHSA-2cpp-j2fc-qhp7 |
| — | awslabs-aws-api-mcp-server (PyPI) | 0.2.14 to before 1.3.9 | 1.3.9 | Patch available | GHSA-2cpp-j2fc-qhp7 |
- AWS API MCP Server VendorAWS Affected 0.2.14 to before 1.3.9 Fixed in 1.3.9 Patch available CNA
- awslabs.aws-api-mcp-server (PyPI) Vendor— Affected 0.2.14 to before 1.3.9 Fixed in 1.3.9 Patch available GHSA-2cpp-j2fc-qhp7
- awslabs-aws-api-mcp-server (PyPI) Vendor— Affected 0.2.14 to before 1.3.9 Fixed in 1.3.9 Patch available GHSA-2cpp-j2fc-qhp7
Remediation
- Fix · CNA AWS API MCP Server (AWS) Fixed in 1.3.9
- Fix · GHSA-2cpp-j2fc-qhp7 awslabs.aws-api-mcp-server (PyPI) Fixed in 1.3.9 Advisory →
- Fix · GHSA-2cpp-j2fc-qhp7 awslabs-aws-api-mcp-server (PyPI) Fixed in 1.3.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4270
- 2026-10-03 Alias added: GHSA-2cpp-j2fc-qhp7
References
Advisory 2
Other 5
- https://github.com/awslabs/mcp/security/advisories/GHSA-2cpp-j2fc-qhp7
- https://aws.amazon.com/security/security-bulletins/2026-007-AWS
- https://github.com/awslabs/mcp
- https://github.com/pypa/advisory-database/tree/main/vulns/awslabs-aws-api-mcp-server/PYSEC-2026-162.yaml
- https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.9
Sources
- CVE-2026-4270 · CVE Program
- CVE-2026-4270 · NVD
- FIRST EPSS
- GHSA-2cpp-j2fc-qhp7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences