AWS CVE-2026-4270

The CVSS 3.1 score of 5.5 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a medium-severity profile with local attack vector, low attack complexity, no privilege requirement, and user interaction as prerequisites. The high confidentiality impact (C:H) is partially mitigated by the local-only attack surface and requirement for user interaction, preventing remote exploitation at scale. The vulnerability is classified as Information Disclosure and Path Traversal per the tags, indicating confirmed proof-of-concept capability and reproducible exploitation. While EPSS and KEV status are not explicitly provided in the intelligence, the availability of a patched version (1.3.9) on PyPI and an official AWS security bulletin (EUVD-2026-12474) suggest vendor awareness and likely active exploitation research. Real-world risk is moderate for organizations running vulnerable versions in multi-tenant or semi-trusted environments where local attackers could enumerate sensitive AWS credentials, configuration files, or application secrets within the server's accessible filesystem.

An attacker with local shell access to a system running a vulnerable AWS API MCP Server instance can craft a specially-formed file path request (e.g., using symbolic links or path traversal sequences) through the MCP client interface to read /etc/passwd, AWS credential files (~/.aws/credentials), or application secrets stored outside the intended workdir boundary. Since the attack vector is local and requires user interaction (e.g., opening a file selection dialog or triggering an MCP request), the attacker must either have an existing foothold on the system or socially engineer a user into executing a malicious MCP client command. A proof-of-concept would demonstrate reading arbitrary files by exploiting the canonicalization flaw in path validation, confirming information disclosure without requiring elevated privileges.