CVE-2026-94046: ACE-MCP Path Traversal Vulnerability

CVE-2026-94046 Overview

CVE-2026-94046 is a path traversal vulnerability [CWE-22] in the 0215AndrewFeng ACE-MCP project through version 4.10.8. The flaw resides in the get_file_snippet function within getFileSnippet.ts, part of the MCP Tool component. An attacker can manipulate the projectRootPath and filePath arguments to read files outside the intended project directory. The isPathInsideProjectRoot guard only verifies that filePath does not escape projectRootPath, but projectRootPath itself is untrusted client input. A public exploit has been published, and the project maintainer has not yet responded to the issue report.

Critical Impact
Remote attackers with low privileges can read arbitrary files accessible to the MCP server process, such as /etc/hosts, by supplying attacker-chosen root and file paths.

Affected Products

0215AndrewFeng ACE-MCP up to and including version 4.10.8
MCP Tool component (getFileSnippet.ts)
Deployments exposing the get_file_snippet MCP function to remote clients

Discovery Timeline

2026-09-20 - CVE-2026-94046 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94046

Vulnerability Analysis

The vulnerability lives in the get_file_snippet MCP tool exposed by ACE-MCP. The function accepts two client-supplied arguments: projectRootPath and filePath. Before reading a file, the code calls isPathInsideProjectRoot to validate that the resolved filePath remains inside projectRootPath. This check is incomplete because it treats the root itself as trusted. An attacker can set projectRootPath=/etc and filePath=hosts, and the guard passes because hosts is indeed inside /etc. The server then returns the contents of /etc/hosts or any other readable file the attacker selects.

Root Cause

The root cause is missing validation of the projectRootPath parameter. The guard function assumes the project root is server-controlled, but both arguments arrive from the MCP client. There is no allowlist of legitimate project roots, no canonicalization against a fixed base directory, and no enforcement that the root belongs to an authenticated workspace. This is a classic path traversal weakness [CWE-22] compounded by a broken trust boundary.

Attack Vector

Exploitation requires network access to the MCP endpoint and low-level authentication to invoke the tool. The attacker submits a crafted MCP request setting projectRootPath to any directory on the host filesystem, such as /etc, /root, or a Windows equivalent, and supplies filePath as the target file relative to that root. The server returns the file contents in the snippet response. No user interaction is required. See the GitHub Public Exploit Issue and the VulDB CVE-2026-94046 entry for the published proof-of-concept.

No verified exploit code is reproduced here. Refer to the ACE-MCP repository and the issue tracker for source-level details.

Detection Methods for CVE-2026-94046

Indicators of Compromise

MCP tool invocations of get_file_snippet where projectRootPath points outside expected workspace directories, such as /etc, /root, /var, C:\Windows, or user profile paths unrelated to active projects.
Response payloads from the ACE-MCP server containing contents of system configuration files (hosts, passwd, shadow, SSH keys, environment files).
Repeated get_file_snippet calls with varying projectRootPath values from a single client session, indicating filesystem enumeration.

Detection Strategies

Log all MCP tool invocations with full argument values and alert when projectRootPath does not match an approved workspace allowlist.
Compare requested paths against a canonicalized set of legitimate project directories and flag any request that resolves outside them.
Correlate MCP request logs with process-level file access telemetry to identify reads of sensitive files triggered by the ACE-MCP process.

Monitoring Recommendations

Enable verbose audit logging on the ACE-MCP service and forward events to a centralized SIEM for retention and correlation.
Monitor the ACE-MCP process for reads of files outside its designated working directory using host-based file integrity or EDR telemetry.
Track authentication events for MCP clients and alert on new or unusual clients invoking file-access tools.

How to Mitigate CVE-2026-94046

Immediate Actions Required

Restrict network exposure of the ACE-MCP service to trusted clients only, using firewall rules or a reverse proxy with authentication.
Run the MCP server as a low-privilege user with filesystem access limited to a dedicated workspace directory.
Disable the get_file_snippet tool until a fix is available if it is not required for operations.

Patch Information

No vendor patch is currently available. The maintainer of the ACE-MCP project was notified via an issue report but has not responded. Track the repository for updates and apply any released fixes promptly. Additional tracking is available at VulDB Vulnerability #407975.

Workarounds

Wrap the MCP server with a filesystem sandbox such as a container with a read-only bind mount limited to the approved project directory.
Deploy an application-layer proxy that validates projectRootPath against a server-side allowlist before forwarding requests to ACE-MCP.
Apply mandatory access controls (AppArmor, SELinux) to prevent the ACE-MCP process from reading files outside its designated workspace.

bash

# Example: run ACE-MCP in a container with a restricted read-only workspace mount
docker run --rm \
  --read-only \
  --user 1000:1000 \
  -v /srv/ace-mcp/workspace:/workspace:ro \
  -p 127.0.0.1:8080:8080 \
  ace-mcp:latest