AWS Discloses Path Traversal Vulnerability in Serverless MCP Server, Urges Upgrade to v0.2.1

Amazon Web Services (AWS) has disclosed a path traversal vulnerability in its open-source AWS Serverless Model Context Protocol (MCP) Server that could allow an actor influencing an MCP agent to access files outside an intended directory. The vulnerability, tracked as CVE-2026-116635, affects versions earlier than v0.2.1.

Published on 2 November 2026 under security bulletin 2026-164-AWS, the advisory identifies a weakness in the deployment status component of the MCP server. Under certain conditions, the issue could allow an actor to read JSON files outside the designated deployment status directory. Where write access is enabled, the same weakness could also permit the creation or overwriting of JSON files outside that directory.

AWS has released a fix in version v0.2.1 and recommends upgrading to the latest version. The company also advises users maintaining forked or derivative versions to incorporate the security fixes.

Understanding CVE-2026-116635

The vulnerability involves improper limitation of a pathname to a restricted directory, commonly associated with path traversal vulnerabilities.

Path traversal occurs when an application does not adequately validate or restrict file paths supplied through user-controlled input. An attacker may exploit this weakness to access files beyond the directory that an application is intended to use.

In this case, AWS identified the deployment status component of its Serverless MCP Server as the affected area.

The vulnerability can be reached through two input conditions identified in the advisory:

• Directory traversal sequences supplied through the project name input.

• An absolute path supplied as the project name.

These conditions could cause the component to access files outside its intended deployment status directory.

How the Vulnerability Could Affect the AWS Serverless MCP Server

The AWS Serverless MCP Server is an open-source MCP server available through the AWS Labs MCP repository. It combines AI assistance with serverless expertise to help developers build serverless applications.

MCP, or Model Context Protocol, provides a standardised way for AI applications and agents to interact with external tools and contextual information.

The vulnerability affects the deployment status component responsible for working with deployment-related information.

According to AWS, an actor who can influence the MCP agent may exploit the pathname handling weakness to access JSON files outside the intended directory.

The potential impact depends on the access conditions:

1. Unintended file reading

An actor could potentially read the contents of JSON files located outside the designated deployment status directory.

2. Unintended file creation

Where write access is enabled, the vulnerability could allow JSON files to be created outside the intended directory.

3. Existing file overwriting

The same write-access condition could allow existing JSON files outside the restricted directory to be overwritten.

AWS specifically identifies these potential outcomes. However, the bulletin does not disclose specific examples of exposed files, affected customer environments, or confirmed exploitation incidents.

Affected Versions and Security Fix

AWS has confirmed that versions earlier than v0.2.1 of the awslabs.aws-serverless-mcp-server package are affected.

The vulnerability has been addressed in version v0.2.1.

AWS has explicitly stated that no workarounds are available.

Consequently, upgrading to the fixed release is the recommended remediation action.

What Developers and Security Teams Should Do

Organisations using the AWS Serverless MCP Server should review their deployments and identify whether they are running an affected version.

The following actions are recommended:

1. Identify affected installations

Check installed versions of awslabs.aws-serverless-mcp-server across development environments and deployment workflows.

2. Upgrade to v0.2.1 or later

Move affected installations to the fixed v0.2.1 release or the latest available version.

3. Review forked and derivative repositories

Organisations maintaining customised forks or derivative implementations should ensure that the security fixes have been incorporated.

4. Review deployment-related file access

Security teams should review how the MCP server handles project names, file paths and access to deployment status data.

5. Validate remediation

After upgrading, verify that the deployed environment uses the corrected release and that any internally maintained versions include the relevant changes.

AWS does not provide a separate workaround, so upgrading remains the stated remediation path.

Why This Vulnerability Matters for AI Agent Security

The disclosure highlights an important security consideration as AI agents become increasingly integrated with developer tools and infrastructure workflows.

MCP servers can connect AI applications with external tools and resources. This makes the security of their input validation, file handling and permission boundaries important considerations.

A weakness in a supporting component can create unintended access paths, even when the intended functionality is limited to a specific directory.

Industry analysis:

The development reflects growing demand for stronger security controls across AI-integrated development environments. Organisations adopting MCP-based tools should consider the security of the entire integration, including the server implementation, input validation and permissions available to connected agents.

For enterprises, this could mean adding MCP server version checks to software inventory processes and including agent-connected developer tools in vulnerability management programmes.

These are broader security considerations, rather than additional capabilities or requirements announced by AWS.

AWS Acknowledges Security Researcher

AWS credited Syed Anas Mohiuddin for collaborating on the vulnerability through its coordinated vulnerability disclosure process.

The bulletin references two additional records:

• CVE-2026-116635 in the CVE database.

• GHSA-r6mm-377j-qg8m in GitHub Security Advisories.

AWS has not disclosed additional details about exploitation, affected customer numbers or specific incidents associated with this vulnerability.

Conclusion

CVE-2026-116635 highlights the importance of securing file-system operations in AI-integrated developer tools.

The path traversal weakness in the AWS Serverless MCP Server could allow an actor influencing an MCP agent to read JSON files outside the intended deployment status directory or, where write access is enabled, create or overwrite files outside that location.

AWS has addressed the issue in version v0.2.1 and confirmed that no workarounds are available.

Organisations using affected versions should prioritise upgrading and ensure that any forked or derivative implementations incorporate the security fix.