{"id":"GHSA-r6mm-377j-qg8m","kind":"vulnerability","aliases":["GHSA-r6mm-377j-qg8m"],"related":[],"title":"CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server","description":"CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\n### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\nBulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST\n\nDescription:\n\nThe AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.\n\nImpacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNo workarounds are available.\n\nReferences:\n\n- CVE-2026-116635\n- GHSA-r6mm-377j-qg8m\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so a project name containing traversal sequences or an absolute path can reach other files. An attacker who can influence the MCP agent can read JSON files outside that directory, and can create or overwrite them where write access is enabled.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","claude-code","lab-disclosure","mcp","serverless"],"not_affected_if":["no-untrusted-agent-input","version-0.2.1-or-later"],"how_to_check":"- Check the installed version of `awslabs.aws-serverless-mcp-server` against the version range below.\n- Look for any deployment flow where a project name supplied by a user or an agent is used in a file path.","fix":"- `awslabs.aws-serverless-mcp-server` `v0.2.1` or later; AWS also says to patch any forked or derivative code.","status":"open","published_at":null,"first_seen_at":"2026-11-02T22:08:22+00:00","triaged_at":"2026-11-02T22:10:29+00:00","updated_at":"2026-11-02T22:10:29+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-02T22:10:29Z","model":"claude-haiku-5-5","output":{"fix":"- `awslabs.aws-serverless-mcp-server` `v0.2.1` or later; AWS also says to patch any forked or derivative code.","reach":"unknown","title":"AWS Serverless MCP Server: path traversal reads and writes JSON files outside directory","impact":"medium","summary":"The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so a project name containing traversal sequences or an absolute path can reach other files. An attacker who can influence the MCP agent can read JSON files outside that directory, and can create or overwrite them where write access is enabled.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","serverless","claude-code"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads or overwrites JSON files outside the deployment status directory.","analyst_note":"","how_to_check":"- Check the installed version of `awslabs.aws-serverless-mcp-server` against the version range below.\n- Look for any deployment flow where a project name supplied by a user or an agent is used in a file path.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.2.1-or-later","no-untrusted-agent-input"],"who_is_affected":"Teams running the AWS Serverless MCP Server below v0.2.1, or forks of it, where an AI agent can supply the project name used by the deployment status component. Exposure depends on whether untrusted input can reach the agent. The sources do not say whether a default configuration is affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4734,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116635':3A,107C,130C,202C,332C '-164':154C '-2026':2A,106C,129C,201C,331C '11/02/2026':165C '13':166C '2026':153C '30':167C '377j':27A,32A,336C 'absolut':73B,272C 'access':102B,249C 'acknowledg':338C 'actor':227C 'address':294C 'agent':86B,233C 'ai':35B,186C 'ai-tool':34B 'allow':225C 'ana':345C 'applic':197C 'assist':187C 'attack':80B 'attent':162C 'avail':328C 'aw':20A,37B,47B,124C,147C,155C,157C,172C 'aws-security@amazon.com':360C 'awslabs.aws':284C,296C 'awslabs/mcp':183C 'build':195C 'bulletin':151C 'certain':204C 'claud':39B 'claude-cod':38B 'code':40B,316C 'collabor':348C 'combin':185C 'compon':17A,54B,121C,144C,219C 'concern':366C 'condit':205C 'contain':68B 'content':158C,237C 'coordin':354C 'creat':96B,254C 'cve':1A,105C,128C,200C,330C 'date':164C 'deploy':15A,52B,119C,142C,217C,244C 'deriv':315C 'descript':170C 'develop':194C 'directori':12A,63B,93B,116C,139C,214C,246C,261C,267C 'disclosur':43B,356C 'email':359C 'enabl':104B,252C 'ensur':311C 'expertis':190C 'file':58B,78B,90B,240C,258C 'fix':323C 'fork':313C 'ghsa':25A,30A,334C 'ghsa-r6mm-377j-qg8m':24A,29A,333C 'id':152C 'identifi':199C 'impact':280C 'import':160C 'improp':4A,108C,131C,206C 'incorpor':320C 'influenc':83B,230C 'input':279C 'intend':62B,243C 'issu':263C,291C,351C 'json':89B,239C,257C 'lab':42B 'lab-disclosur':41B 'latest':308C 'like':341C 'limit':5A,109C,132C,207C 'mcp':22A,44B,49B,85B,126C,149C,174C,181C,222C,232C,287C,299C 'might':224C 'mohiuddin':346C 'name':67B,278C 'new':322C 'open':179C 'open-sourc':178C 'outsid':91B,241C,259C 'overwrit':98B,256C 'patch':318C 'path':59B,74B,273C 'pathnam':8A,112C,135C,210C 'pleas':358C 'pm':168C 'process':357C 'project':66B,277C 'pst':169C 'public':163C 'qg8m':28A,33A,337C 'question':364C 'r6mm':26A,31A,335C 'reach':76B 'reachabl':265C 'read':88B,235C 'recommend':304C 'refer':329C 'requir':161C 'resolut':289C 'restrict':11A,57B,115C,138C,213C 'scope':156C 'secur':363C 'sequenc':70B,269C 'server':23A,50B,127C,150C,175C,182C,223C,288C,300C 'serverless':21A,45B,48B,125C,148C,173C,189C,196C,286C,298C 'serverless-mcp-serv':285C,297C 'sourc':180C 'status':16A,53B,120C,143C,218C,245C 'streamlin':192C 'suppli':274C 'sy':344C 'thank':343C 'tool':36B 'travers':69B,268C 'type':159C 'upgrad':305C 'v0.2.1':282C,302C 'version':281C,301C,309C 'vulner':355C 'workaround':324C,326C 'would':340C 'write':101B,248C","nicknames":[],"mitigations":[],"who_affected":"Teams running the AWS Serverless MCP Server below v0.2.1, or forks of it, where an AI agent can supply the project name used by the deployment status component. Exposure depends on whether untrusted input can reach the agent. The sources do not say whether a default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","claudecode","high","labdisclosure","mcp","serverless"],"first_public_at":"2026-11-02T21:43:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/#GHSA-r6mm-377j-qg8m","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T22:08:22+00:00","fetched_at":"2026-11-02T22:08:22+00:00","note":"AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server"}],"documents":[{"id":54088,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/","title":"AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\n### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server\n\nBulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST\n\nDescription:\n\nThe AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.\n\nImpacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server\n\nResolution:\n\nThis issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nNo workarounds are available.\n\nReferences:\n\n- CVE-2026-116635\n- GHSA-r6mm-377j-qg8m\n\nAcknowledgement:\n\nWe would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-02T21:43:24+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}