---
id: "CVE-2026-116635"
kind: "vulnerability"
aliases: ["CVE-2026-116635"]
title: "Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless\u2026"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "claude-code", "cursor", "lab-disclosure", "mcp", "serverless"]
not_affected_if: ["no-mcp-server-installed", "version-0.2.1-or-later"]
published_at: "2026-11-02T22:17:19+00:00"
first_seen_at: "2026-11-02T22:08:22+00:00"
updated_at: "2026-11-02T22:35:43+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/", "first_seen_at": "2026-11-02T22:08:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116635", "first_seen_at": "2026-11-02T22:35:43+00:00"}]
---

# Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless…

The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so an attacker who can influence the MCP agent can read JSON files outside that directory. Where write access is enabled, the attacker can also create or overwrite JSON files outside it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of awslabs.aws-serverless-mcp-server and compare it against `v0.2.1`
- Look for the package in your MCP client configuration or lockfiles
- Confirm whether the deployment status tool is exposed to untrusted input such as project names

## Fix

- awslabs.aws-serverless-mcp-server: upgrade to `v0.2.1` or later; the bulletin says forked or derivative code must also be patched

## Timeline

- 2026-11-02T22:08:22+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/ — AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
- 2026-11-02T22:35:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116635

## Documents

- [advisory] Vendor advisory: github.com https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m
- [mentions] AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/

## From the sources

CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

Bulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST

Description:

The AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.

Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server

Resolution:

This issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

No workarounds are available.

References:

- CVE-2026-116635
- GHSA-r6mm-377j-qg8m

Acknowledgement:

We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_