CVE-2026-4270

MEDIUM

5.5

Descripcion

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

Detalles CVE

Puntuacion CVSS v3.15.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/16/2026

Ultima modificacion3/17/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-424

Referencias

https://aws.amazon.com/security/security-bulletins/2026-007-AWS/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.9/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.