---
id: "GHSA-r6mm-377j-qg8m"
kind: "vulnerability"
aliases: ["GHSA-r6mm-377j-qg8m"]
title: "CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "claude-code", "lab-disclosure", "mcp", "serverless"]
not_affected_if: ["no-untrusted-agent-input", "version-0.2.1-or-later"]
published_at: null
first_seen_at: "2026-11-02T22:08:22+00:00"
updated_at: "2026-11-02T22:10:29+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/", "first_seen_at": "2026-11-02T22:08:22+00:00"}]
---

# CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

The AWS Serverless MCP Server's deployment status component does not restrict file paths to its intended directory, so a project name containing traversal sequences or an absolute path can reach other files. An attacker who can influence the MCP agent can read JSON files outside that directory, and can create or overwrite them where write access is enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `awslabs.aws-serverless-mcp-server` against the version range below.
- Look for any deployment flow where a project name supplied by a user or an agent is used in a file path.

## Fix

- `awslabs.aws-serverless-mcp-server` `v0.2.1` or later; AWS also says to patch any forked or derivative code.

## Timeline

- 2026-11-02T22:08:22+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/ — AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

## Documents

- [mentions] AWS: CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/

## From the sources

CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

### CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

Bulletin ID: 2026-164-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 13:30 PM PST

Description:

The AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.

Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server

Resolution:

This issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

No workarounds are available.

References:

- CVE-2026-116635
- GHSA-r6mm-377j-qg8m

Acknowledgement:

We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_