CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 11/02/2026 13:30 PM PST
Description:
The AWS Serverless MCP Server is an open-source MCP server (awslabs/mcp) that combines AI assistance with serverless expertise to streamline how developers build serverless applications. We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server
Resolution:
This issue has been addressed in awslabs.aws-serverless-mcp-server version v0.2.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
No workarounds are available.
References:
Acknowledgement:
We would like to thank Syed Anas Mohiuddin for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.