CVE-2026-116635

AWS Serverless MCP project names can escape deployment status storage

AWS · AWS Serverless MCP Server

First documented disclosure · Review checkpoint

Summary

An influenced agent can read outside the status directory; enabled writes can overwrite JSON files.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed disclosure and controlled research; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Deployment status paths accept traversal segments or absolute paths in the project name.

Conditions required

The actor can influence an MCP agent to supply a crafted project name. Overwrites additionally require --enable-write and filesystem access.

Potential impact

Valid JSON files can enter agent context; writes use deployment metadata and can clobber an existing JSON file. Arbitrary code execution is not established.

Affected versions and configurations

awslabs.aws-serverless-mcp-server before 0.2.1.

Fix and mitigation status

0.2.1 fixes this issue.

Practical next steps

Upgrade to 0.2.1 or a later supported release and patch derivatives. AWS lists no workaround; disabling write access alone leaves the read exposure.

Operating lesson

Validate resolved filesystem boundaries independently of an agent’s requested project name.

Evidence and limits

AWS disclosure and CNA November 2; the fixed package was uploaded October 30. AWS CNA scores this 6.9 CVSS 4.0; its GitHub advisory uses 6.1 v3.1. Publication of a package is distinguished from disclosure of the flaw.

Sources