Live › vulnerability › CVE-2026-116635
The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so an attacker who can influence the MCP agent can read JSON files outside that directory. Where write access is enabled, the attacker can also create or overwrite JSON files outside it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 22:08 UTC, 0h before NVD. All times on this page are UTC.
Teams running the AWS Serverless MCP Server below v0.2.1, where an MCP agent can pass project names into the deployment status component. The bulletin says the issue is reachable through directory traversal sequences or an absolute path in the project name input. Teams on v0.2.1 or later, or not running this MCP server, can skip it.
No product ranges from the sources yet.
v0.2.1v0.2.1 or later; the bulletin says forked or derivative code must also be patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST
Description:
The AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server
Resolution:
This issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
No workarounds are available.
References:
Acknowledgement:
We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-116635")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.