Plango
Get Plango

For developers

Mac security

← AI agent vulnerabilities

CVE-2026-4270

AWS API MCP Server

5.5
Severity
Medium
Published
March 16, 2026
Last modified
June 17, 2026

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness

References

CVE-2026-4270 on NVD

Listed in

MediumMCP servers

More AWS API MCP Server CVEs

Jul 23
CVE-2026-165847.0

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the…