CVE-2026-4270

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context.

To remediate this issue, users should upgrade to version 1.3.9.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-424

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-427006.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-sliCVE-2026-427027.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows ReflectCVE-2026-427048.1Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.CVE-2026-427057.5Unauthenticated Broken Access Control in Grand News <= 3.4 versions.CVE-2026-427067.5Unauthenticated Broken Access Control in DK <= 3.2.1 versions.CVE-2026-427087.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-authoCVE-2026-427097.1Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.CVE-2026-42717.5A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 serveCVE-2026-427107.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allowsCVE-2026-427117.1Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.CVE-2026-427128.5Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.CVE-2026-427137.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll pos
CVE-2026-4270: Medium severity, CVSS 5.5 | Vulnix