Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If someone can steer your AI agent, they can steer the MCP servers it calls. AWS disclosed CVE-2026-116635 in the AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server before v0.2.1). Under certain conditions, a path bug lets that actor read JSON files outside the deployment status directory, and create or overwrite them if write access is enabled. Update to v0.2.1 and keep write access off unless you need it.
AWS disclosed a security bug (CVE-2026-116635) in its Serverless MCP Server: before version 0.2.1, a path flaw let write operations read or write JSON files outside the intended status folder if write access was enabled. Any agent that can be steered into calling that server could be steered further. Fix: update to v0.2.1 and keep write access off by default.
AWS公式のServerless MCPにパス・トラバーサル（CVE-2026-116635）。プロジェクト名の検証不足で、状態ディレクトリ外のJSONを読み取り、書き込み有効時は上書きも。影響は0.2.1未満。修正版の検証と、手元で確認した挙動を整理しました。 https://x.com/i/article/2117558212559810560