{"id":"CVE-2026-116635","kind":"vulnerability","aliases":["CVE-2026-116635"],"related":[],"title":"Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless…","description":"CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\n### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\nBulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST\n\nDescription:\n\nThe AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.\n\nImpacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNo workarounds are available.\n\nReferences:\n\n- CVE-2026-116635\n- GHSA-r6mm-377j-qg8m\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so an attacker who can influence the MCP agent can read JSON files outside that directory. Where write access is enabled, the attacker can also create or overwrite JSON files outside it.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","claude-code","cursor","lab-disclosure","mcp","serverless"],"not_affected_if":["no-mcp-server-installed","version-0.2.1-or-later"],"how_to_check":"- Check the installed version of awslabs.aws-serverless-mcp-server and compare it against `v0.2.1`\n- Look for the package in your MCP client configuration or lockfiles\n- Confirm whether the deployment status tool is exposed to untrusted input such as project names","fix":"- awslabs.aws-serverless-mcp-server: upgrade to `v0.2.1` or later; the bulletin says forked or derivative code must also be patched","status":"open","published_at":"2026-11-02T22:17:19+00:00","first_seen_at":"2026-11-02T22:08:22+00:00","triaged_at":"2026-11-02T22:10:30+00:00","updated_at":"2026-11-02T22:35:43+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-02T22:10:30Z","model":"claude-haiku-5-5","output":{"fix":"- awslabs.aws-serverless-mcp-server: upgrade to `v0.2.1` or later; the bulletin says forked or derivative code must also be patched","reach":"local","title":"AWS Serverless MCP Server: path traversal reads and overwrites JSON files","impact":"medium","summary":"The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so an attacker who can influence the MCP agent can read JSON files outside that directory. Where write access is enabled, the attacker can also create or overwrite JSON files outside it.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","serverless","claude-code","cursor"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads or overwrites JSON files outside the deployment directory","analyst_note":"Confirm the exact preconditions for write access and whether the MCP agent path is reachable from untrusted input; see GHSA-r6mm-377j-qg8m and the AWS bulletin 2026-164-AWS.","how_to_check":"- Check the installed version of awslabs.aws-serverless-mcp-server and compare it against `v0.2.1`\n- Look for the package in your MCP client configuration or lockfiles\n- Confirm whether the deployment status tool is exposed to untrusted input such as project names","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.2.1-or-later","no-mcp-server-installed"],"who_is_affected":"Teams running the AWS Serverless MCP Server below v0.2.1, where an MCP agent can pass project names into the deployment status component. The bulletin says the issue is reachable through directory traversal sequences or an absolute path in the project name input. Teams on v0.2.1 or later, or not running this MCP server, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000819,"input_tokens":4718,"output_tokens":695,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116635':21A,24A,89C,112C,184C,314C '-164':136C '-2026':20A,23A,88C,111C,183C,313C '11/02/2026':147C '13':148C '2026':135C '30':149C '377j':318C 'absolut':254C 'access':74B,231C 'acknowledg':320C 'actor':209C 'address':276C 'agent':64B,215C 'ai':26B,168C 'ai-tool':25B 'allow':207C 'also':80B 'ana':327C 'applic':179C 'assist':169C 'attack':58B,78B 'attent':144C 'avail':310C 'aw':17A,28B,39B,106C,129C,137C,139C,154C 'aws-security@amazon.com':342C 'awslabs.aws':266C,278C 'awslabs/mcp':165C 'build':177C 'bulletin':133C 'certain':186C 'claud':30B 'claude-cod':29B 'code':31B,298C 'collabor':330C 'combin':167C 'compon':14A,46B,103C,126C,201C 'concern':348C 'condit':187C 'content':140C,219C 'coordin':336C 'creat':81B,236C 'cursor':32B 'cve':19A,22A,87C,110C,182C,312C 'date':146C 'deploy':12A,44B,101C,124C,199C,226C 'deriv':297C 'descript':152C 'develop':176C 'directori':9A,55B,71B,98C,121C,196C,228C,243C,249C 'disclosur':35B,338C 'email':341C 'enabl':76B,234C 'ensur':293C 'expertis':172C 'file':50B,68B,85B,222C,240C 'fix':305C 'fork':295C 'ghsa':316C 'ghsa-r6mm-377j-qg8m':315C 'id':134C 'identifi':181C 'impact':262C 'import':142C 'improp':1A,90C,113C,188C 'incorpor':302C 'influenc':61B,212C 'input':261C 'intend':54B,225C 'issu':245C,273C,333C 'json':67B,84B,221C,239C 'lab':34B 'lab-disclosur':33B 'latest':290C 'like':323C 'limit':2A,91C,114C,189C 'mcp':36B,41B,63B,108C,131C,156C,163C,204C,214C,269C,281C 'might':206C 'mohiuddin':328C 'name':260C 'new':304C 'open':161C 'open-sourc':160C 'outsid':69B,86B,223C,241C 'overwrit':83B,238C 'patch':300C 'path':51B,255C 'pathnam':5A,94C,117C,192C 'pleas':340C 'pm':150C 'process':339C 'project':259C 'pst':151C 'public':145C 'qg8m':319C 'question':346C 'r6mm':317C 'reachabl':247C 'read':66B,217C 'recommend':286C 'refer':311C 'requir':143C 'resolut':271C 'restrict':8A,49B,97C,120C,195C 'scope':138C 'secur':345C 'sequenc':251C 'server':42B,109C,132C,157C,164C,205C,270C,282C 'serverless':18A,37B,40B,107C,130C,155C,171C,178C,268C,280C 'serverless-mcp-serv':267C,279C 'sourc':162C 'status':13A,45B,102C,125C,200C,227C 'streamlin':174C 'suppli':256C 'sy':326C 'thank':325C 'tool':27B 'travers':250C 'type':141C 'upgrad':287C 'v0.2.1':264C,284C 'version':263C,283C,291C 'vulner':337C 'workaround':306C,308C 'would':322C 'write':73B,230C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AWS Serverless MCP Server below v0.2.1, where an MCP agent can pass project names into the deployment status component. The bulletin says the issue is reachable through directory traversal sequences or an absolute path in the project name input. Teams on v0.2.1 or later, or not running this MCP server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","claudecode","cursor","labdisclosure","mcp","medium","serverless"],"first_public_at":"2026-11-02T21:34:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/#CVE-2026-116635","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T22:08:22+00:00","fetched_at":"2026-11-02T22:08:22+00:00","note":"AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server"},{"source":"nvd","external_id":"CVE-2026-116635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116635","severity":null,"published_at":"2026-11-02T22:17:19+00:00","modified_at":"2026-11-02T22:17:19+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","fetched_at":"2026-11-02T22:35:43+00:00","note":null}],"documents":[{"id":54088,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/","title":"AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\n### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\nBulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST\n\nDescription:\n\nThe AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.\n\nImpacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNo workarounds are available.\n\nReferences:\n\n- CVE-2026-116635\n- GHSA-r6mm-377j-qg8m\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-02T21:43:24+00:00","relation":"mentions","confidence":null,"note":null},{"id":54166,"url":"https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T21:34:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}