Live › vulnerability › GHSA-r6mm-377j-qg8m
The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so a project name containing traversal sequences or an absolute path can reach other files. An attacker who can influence the MCP agent can read JSON files outside that directory, and can create or overwrite them where write access is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 22:08 UTC. All times on this page are UTC.
Teams running the AWS Serverless MCP Server below v0.2.1, or forks of it, where an AI agent can supply the project name used by the deployment status component. Exposure depends on whether untrusted input can reach the agent. The sources do not say whether a default configuration is affected.
No product ranges from the sources yet.
awslabs.aws-serverless-mcp-server against the version range below.awslabs.aws-serverless-mcp-server v0.2.1 or later; AWS also says to patch any forked or derivative code.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST
Description:
The AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server
Resolution:
This issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
No workarounds are available.
References:
Acknowledgement:
We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-r6mm-377j-qg8m")