Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in
Vulnerability

CVE-2026-116635

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1.

CVSS score (v4.0)6.9Medium
Not on CISA KEV list

Am I affected?

Sign in and add the software you use to your watchlist: we check it against every new vulnerability.

Show me how to fix it

Timeline

  1. First covered by RedTeamDaily
  2. Published by NVD
  3. Last updated by NVD

Coverage

AWS Security Bulletins·

AWS Serverless MCP Server path traversal flaw tracked as CVE-2026-116635

has published bulletin 2026-164-AWS for CVE-2026-116635, a path traversal flaw in the deployment status component of the AWS Serverless MCP Server. An actor who can influence the MCP agent may read JSON files outside the intended deployment status directory, and may create or overwrite them where write access has been enabled. The bulletin lists the impacted version as v0.2.1.

Am I affected?
Ask
1

Sources: NVD and CISA known exploited vulnerabilities catalogue.