Executive brief
The AWS API MCP Server is a tool that allows AI assistants to manage AWS resources using standard command-line tools. A security flaw in how the server handles file paths could allow an attacker to bypass directory restrictions and access sensitive local files on the system where the server is running. This could lead to the exposure of private data or configuration files to the AI assistant's context.
Technical details
A vulnerability classified as Improper Protection of Alternate Path (CWE-424) exists in the AWS API MCP Server's 'no-access' and 'workdir' configurations. The root cause is insufficient validation of file path arguments passed to AWS CLI commands through the MCP bridge. An attacker can exploit this by providing specially crafted paths to bypass intended directory isolation, allowing the retrieval of arbitrary local file contents within the application context. Exploitation requires local access and some level of user interaction (passive). The issue is resolved in version 1.3.9.
Affected products
- AWS aws-api-mcp-server >= 0.2.14, < 1.3.9
Timeline
- 2026-03-16: disclosed
- 2026-03-16: patched: Version 1.3.9 released
- 2026-03-17: advisory
References
- https://github.com/awslabs/mcp/security/advisories/GHSA-2cpp-j2fc-qhp7
- https://aws.amazon.com/security/security-bulletins/2026-007-AWS
- https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.9
- https://github.com/pypa/advisory-database/tree/main/vulns/awslabs-aws-api-mcp-server/PYSEC-2026-162.yaml
- https://api.github.com/repos/awslabs/mcp/security-advisories/GHSA-2cpp-j2fc-qhp7