# AWS Serverless MCP Server: a project name reads files outside its directory

> AWS Serverless MCP Server could be steered into reading JSON files from outside the directory it was supposed to stay in.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Amazon Web Services
- **Disclosed:** 2026-11-02
- **CVE:** CVE-2026-116635
- **CVSS:** 6.1
- **Affects:** AWS Serverless MCP Server, awslabs.aws-serverless-mcp-server (PyPI)
- **Research by:** Se Hoon, Syed Anas Mohiuddin
- **Primary source:** https://aws.amazon.com/security/security-bulletins/2026-164-aws/
- **Page:** https://theinjection.dev/items/aws-serverless-mcp-deployment-status-traversal/

AWS Serverless MCP Server before 0.2.1 let an actor who can influence the MCP agent read JSON files outside its deployment status directory, and overwrite them when write access is enabled. AWS shipped the fix on November 2, 2026.

## What happened

Amazon Web Services published security bulletin 2026-164-AWS and advisory GHSA-r6mm-377j-qg8m on November 2, 2026 for CVE-2026-116635, a path traversal flaw in the AWS Serverless MCP Server. The GitHub advisory credits Se Hoon (bebold6133) as the reporter, while the AWS bulletin thanks Syed Anas Mohiuddin. Version 0.2.1 fixes it.

## How it works

The deployment status component builds a file path from the project name input without restricting it to the intended directory. Directory traversal sequences or an absolute path in that input move the read elsewhere, and a path that ends at a valid JSON file returns that file's contents into the agent's context. With the write flag set, the same input can create or overwrite JSON files outside the directory, replacing serverless deployment metadata.

## Who is affected

Versions of awslabs.aws-serverless-mcp-server earlier than 0.2.1 are affected, and AWS says forks and derivative code need the same patch. Reading needs only an actor who can influence the MCP agent. Writing additionally needs the server to run with the --enable-write flag, which is not on by default.

## What to do

Upgrade awslabs.aws-serverless-mcp-server to 0.2.1 and patch any forked or derivative code. AWS lists no workarounds for earlier versions.

## Quick facts

- **Affected:** awslabs.aws-serverless-mcp-server before 0.2.1
- **Fixed in:** 0.2.1
- **CVE:** CVE-2026-116635
- **CVSS:** 6.1 (CVSS 3.1), 6.9 (CVSS 4.0), both medium
- **Found by:** Se Hoon (bebold6133), per the GitHub advisory
- **Disclosed:** November 2, 2026
- **Status:** Patched, no workarounds

## Questions

### Is the AWS Serverless MCP Server path traversal patched?

AWS fixed CVE-2026-116635 in awslabs.aws-serverless-mcp-server 0.2.1, published to PyPI and announced in security bulletin 2026-164-AWS on November 2, 2026. AWS lists no workarounds for earlier versions, so upgrading is the only remedy. Anyone running a fork or derivative of the deployment status component has to apply the same path restriction themselves.

### Can this flaw let an attacker write files on the host?

Writing requires the AWS Serverless MCP Server to run with the --enable-write flag, which is off by default. With it set, the advisory says an existing JSON file outside the deployment status directory can be created or overwritten, and the data replaced is serverless deployment metadata. Without that flag the impact is limited to reading JSON files into the agent's context.

### Who can trigger the AWS Serverless MCP Server traversal?

AWS describes the attacker as an actor who can influence the MCP agent, meaning anyone whose content reaches the agent's project name input. The CVSS 3.1 vector records a local attack vector with user interaction required, so a user has to drive the agent into calling the deployment status tool. No authentication is needed beyond that influence.

## Sources

1. [AWS Bulletin 2026-164](https://aws.amazon.com/security/security-bulletins/2026-164-aws/)
2. [GitHub Advisory](https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m)
3. [PyPI 0.2.1 Release](https://pypi.org/project/awslabs.aws-serverless-mcp-server/0.2.1/)