Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-4270
5.5
MEDIUMCVSS v3
Published
March 16, 2026
Affected
1 project
Assigned by
ff89ba41-3aa1-4d27-914a-91399e9639e5
Severity scale
010
Description
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.
awslabs.aws-api-mcp-serverPython Package IndexModel Context Protocol (MCP) server for interacting with AWS
Python Package IndexModel Context Protocol (MCP) server for interacting with AWS>= 0.2.14, < 1.3.9NVD