Is the AWS Serverless MCP Server path traversal patched?

AWS fixed CVE-2026-116635 in awslabs.aws-serverless-mcp-server 0.2.1, published to PyPI and announced in security bulletin 2026-164-AWS on November 2, 2026. AWS lists no workarounds for earlier versions, so upgrading is the only remedy. Anyone running a fork or derivative of the deployment status component has to apply the same path restriction themselves.

Can this flaw let an attacker write files on the host?

Writing requires the AWS Serverless MCP Server to run with the --enable-write flag, which is off by default. With it set, the advisory says an existing JSON file outside the deployment status directory can be created or overwritten, and the data replaced is serverless deployment metadata. Without that flag the impact is limited to reading JSON files into the agent's context.

Who can trigger the AWS Serverless MCP Server traversal?

AWS describes the attacker as an actor who can influence the MCP agent, meaning anyone whose content reaches the agent's project name input. The CVSS 3.1 vector records a local attack vector with user interaction required, so a user has to drive the agent into calling the deployment status tool. No authentication is needed beyond that influence.

MEDVulnerability

AWS Serverless MCP Server: a project name reads files outside its directory

AWS Serverless MCP Server could be steered into reading JSON files from outside the directory it was supposed to stay in.

November 2, 2026 · Amazon Web Services · Research by Se Hoon, Syed Anas Mohiuddin

CVE-2026-116635

MEDVulnerability

AWS Serverless MCP Server before 0.2.1 let an actor who can influence the MCP agent read JSON files outside its deployment status directory, and overwrite them when write access is enabled. AWS shipped the fix on November 2, 2026.

01What happened

Amazon Web Services published security bulletin 2026-164-AWS and advisory GHSA-r6mm-377j-qg8m on November 2, 2026 for CVE-2026-116635, a path traversal flaw in the AWS Serverless MCP Server. The GitHub advisory credits Se Hoon (bebold6133) as the reporter, while the AWS bulletin thanks Syed Anas Mohiuddin. Version 0.2.1 fixes it.

02How it works

The deployment status component builds a file path from the project name input without restricting it to the intended directory. Directory traversal sequences or an absolute path in that input move the read elsewhere, and a path that ends at a valid JSON file returns that file's contents into the agent's context. With the write flag set, the same input can create or overwrite JSON files outside the directory, replacing serverless deployment metadata.

03Who is affected

Versions of awslabs.aws-serverless-mcp-server earlier than 0.2.1 are affected, and AWS says forks and derivative code need the same patch. Reading needs only an actor who can influence the MCP agent. Writing additionally needs the server to run with the --enable-write flag, which is not on by default.

04What to do

Upgrade awslabs.aws-serverless-mcp-server to 0.2.1 and patch any forked or derivative code. AWS lists no workarounds for earlier versions.

Questions people ask

Is the AWS Serverless MCP Server path traversal patched?: AWS fixed CVE-2026-116635 in awslabs.aws-serverless-mcp-server 0.2.1, published to PyPI and announced in security bulletin 2026-164-AWS on November 2, 2026. AWS lists no workarounds for earlier versions, so upgrading is the only remedy. Anyone running a fork or derivative of the deployment status component has to apply the same path restriction themselves.
Can this flaw let an attacker write files on the host?: Writing requires the AWS Serverless MCP Server to run with the --enable-write flag, which is off by default. With it set, the advisory says an existing JSON file outside the deployment status directory can be created or overwritten, and the data replaced is serverless deployment metadata. Without that flag the impact is limited to reading JSON files into the agent's context.
Who can trigger the AWS Serverless MCP Server traversal?: AWS describes the attacker as an actor who can influence the MCP agent, meaning anyone whose content reaches the agent's project name input. The CVSS 3.1 vector records a local attack vector with user interaction required, so a user has to drive the agent into calling the deployment status tool. No authentication is needed beyond that influence.

Sources 3 links, all fetched

1aws.amazon.comAWS Bulletin 2026-164
2github.comGitHub Advisory
3pypi.orgPyPI 0.2.1 Release