MEDIUM

CVE-2026-116635

Published 2026-11-02 CVSS v3.1

View on NVD View on MITRE Check if this affects your version

CVSS Score

6.1

Description

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.

To remediate this issue, users should upgrade to version v0.2.1.

Weakness Classification (CWE)

CWE-23

CWE-36

References

https://aws.amazon.com/security/security-bulletins/2026-164-aws/ https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m https://pypi.org/project/awslabs.aws-serverless-mcp-server/0.2.1/

Primary Sources

Always verify findings against the primary CVE record before acting. Both sources below are public-domain and authoritative.

NVD — NIST Official CVE enrichment, CVSS, CPE

MITRE CVE Program Official CVE record of authority

Does this affect your version?

Use the CVE Detector to check if a specific product version is impacted by this vulnerability, along with 100+ other CVEs.

Open Detector

Back to CVE Dashboard Search Other CVEs

CVE data aggregated from the National Vulnerability Database (NVD, public domain) and enriched by dbcve.org.