What happened
NVD published CVE-2026-94046 on 2026-09-20 (CVSS 4.3, CWE-22). The guard only validates the relative path against a root chosen by the untrusted client. Public exploit noted; project had not responded as of publication.
Why it matters
An agent file-read tool with a defeated containment check is an arbitrary-file disclosure primitive (source code, env, secrets) exposed to any caller or prompt-injected agent driving the tool.
Attack vector
Remote manipulation of projectRootPath/filePath in the get_file_snippet MCP tool; the containment check is defeated by supplying '/etc' (or '/' as the 'root'), reading arbitrary files from the host.
Affected systems
0215AndrewFeng ACE-MCP 4.10.0–4.10.8 (getFileSnippet.ts)
Mitigation
No vendor patch at publication; treat MCP file tools as needing server-side canonicalization of both the root and the path, and restrict who can invoke them. https://vuldb.com/cve/CVE-2026-94046