AWS API MCP File Access Restriction Bypass

Vulnerability

Overview

The AWS API MCP Server is an open-source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services through CLI commands. It includes a configurable file access feature that controls how AWS CLI commands interact with the local file system. By default, file operations are restricted to a designated working directory (workdir), but this can be configured to allow unrestricted access or to block all local file path arguments (no-access). CVE-2026-4270 is an Improper Protection of Alternate Path vulnerability in the no-access and workdir and no-access features of the server, affecting versions >= 0.2.14 and < 1.3.9 on all platforms [1][2][3].

Exploitation

The vulnerability allows an attacker to bypass the intended file access restrictions by using alternate paths that are not properly validated. This can be exploited without authentication, as the MCP server may be exposed to untrusted inputs. The attack surface is the MCP client application context, where arbitrary local file contents can be exposed [3][4].

Impact

Successful exploitation could lead to the exposure of arbitrary local file contents to the MCP client application, potentially leaking sensitive information such as configuration files, credentials, or other data stored on the host system [2][3].

Mitigation

The issue has been addressed in version 1.3.9 of the AWS API MCP Server. Users are strongly recommended to upgrade to this version or later. No workarounds are available [3][available [3][4]. The vulnerability is also tracked as GHSA-2cpp-j2fc-qhp7 [4].