--- url: "https://www.xcademia.com/news/aws-discloses-path-traversal-vulnerability-in-serverless-mcp-server-urges-upgrade-to-v0-2-1" title: "AWS Discloses Path Traversal Vulnerability in Serverless MCP Server, Urges Upgrade to v0.2.1" description: "AWS fixes CVE-2026-116635, a path traversal flaw in its Serverless MCP Server. Upgrade to v0.2.1 to address the vulnerability." publishedAt: "2026-11-03T09:01:31.037+00:00" updatedAt: "2026-11-03T12:07:22.725599+00:00" type: news category: cybersecurity source_name: Amazon Web Services (AWS) Security Bulletins source_url: "https://aws.amazon.com/security/security-bulletins/2026-164-aws/" tags: - "#AWSSecurity" - "#CVE2026116635" - "#ServerlessMCP" - "#AIAgentSecurity" - "#PathTraversal" - "#VulnerabilityManagement" - "#CloudSecurity" - "#ModelContextProtocol" --- # AWS Discloses Path Traversal Vulnerability in Serverless MCP Server, Urges Upgrade to v0.2.1 > AWS has disclosed CVE-2026-116635, a path traversal vulnerability in its open-source Serverless MCP Server that could expose JSON files outside an intended directory or allow unauthorised file modification. Users should upgrade to v0.2.1. Source: **Amazon Web Services (AWS) Security Bulletins** · 3 November 2026 Amazon Web Services (AWS) has disclosed a path traversal vulnerability in its open-source AWS Serverless Model Context Protocol (MCP) Server that could allow an actor influencing an MCP agent to access files outside an intended directory. The vulnerability, tracked as **CVE-2026-116635**, affects versions earlier than v0.2.1. Published on 2 November 2026 under security bulletin **2026-164-AWS**, the advisory identifies a weakness in the deployment status component of the MCP server. Under certain conditions, the issue could allow an actor to read JSON files outside the designated deployment status directory. Where write access is enabled, the same weakness could also permit the creation or overwriting of JSON files outside that directory. AWS has released a fix in version **v0.2.1** and recommends upgrading to the latest version. The company also advises users maintaining forked or derivative versions to incorporate the security fixes. ## Understanding CVE-2026-116635 The vulnerability involves improper limitation of a pathname to a restricted directory, commonly associated with path traversal vulnerabilities. Path traversal occurs when an application does not adequately validate or restrict file paths supplied through user-controlled input. An attacker may exploit this weakness to access files beyond the directory that an application is intended to use. In this case, AWS identified the deployment status component of its Serverless MCP Server as the affected area. The vulnerability can be reached through two input conditions identified in the advisory: - Directory traversal sequences supplied through the project name input. - An absolute path supplied as the project name. These conditions could cause the component to access files outside its intended deployment status directory. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793696405567-info1--152-.webp) ## How the Vulnerability Could Affect the AWS Serverless MCP Server The AWS Serverless MCP Server is an open-source MCP server available through the AWS Labs MCP repository. It combines AI assistance with serverless expertise to help developers build serverless applications. MCP, or Model Context Protocol, provides a standardised way for AI applications and agents to interact with external tools and contextual information. The vulnerability affects the deployment status component responsible for working with deployment-related information. According to AWS, an actor who can influence the MCP agent may exploit the pathname handling weakness to access JSON files outside the intended directory. The potential impact depends on the access conditions: **1. Unintended file reading** An actor could potentially read the contents of JSON files located outside the designated deployment status directory. **2. Unintended file creation** Where write access is enabled, the vulnerability could allow JSON files to be created outside the intended directory. **3. Existing file overwriting** The same write-access condition could allow existing JSON files outside the restricted directory to be overwritten. AWS specifically identifies these potential outcomes. However, the bulletin does not disclose specific examples of exposed files, affected customer environments, or confirmed exploitation incidents. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793696430067-info2--153-.webp) ## Affected Versions and Security Fix AWS has confirmed that versions earlier than v0.2.1 of the `awslabs.aws-serverless-mcp-server` package are affected. The vulnerability has been addressed in version v0.2.1. Security detail Information Vulnerability CVE-2026-116635 Bulletin 2026-164-AWS Affected component Deployment status component Affected software AWS Serverless MCP Server Affected versions Earlier than v0.2.1 Fixed version v0.2.1 AWS classification Important Available workaround None AWS has explicitly stated that no workarounds are available. Consequently, upgrading to the fixed release is the recommended remediation action. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793696469687-info3--152-.webp) ## What Developers and Security Teams Should Do Organisations using the AWS Serverless MCP Server should review their deployments and identify whether they are running an affected version. The following actions are recommended: **1. Identify affected installations** Check installed versions of `awslabs.aws-serverless-mcp-server` across development environments and deployment workflows. **2. Upgrade to v0.2.1 or later** Move affected installations to the fixed v0.2.1 release or the latest available version. ** 3. Review forked and derivative repositories** Organisations maintaining customised forks or derivative implementations should ensure that the security fixes have been incorporated. **4. Review deployment-related file access** Security teams should review how the MCP server handles project names, file paths and access to deployment status data. **5. Validate remediation** After upgrading, verify that the deployed environment uses the corrected release and that any internally maintained versions include the relevant changes. AWS does not provide a separate workaround, so upgrading remains the stated remediation path. ## Why This Vulnerability Matters for AI Agent Security The disclosure highlights an important security consideration as AI agents become increasingly integrated with developer tools and infrastructure workflows. MCP servers can connect AI applications with external tools and resources. This makes the security of their input validation, file handling and permission boundaries important considerations. A weakness in a supporting component can create unintended access paths, even when the intended functionality is limited to a specific directory. **Industry analysis:** The development reflects growing demand for stronger security controls across AI-integrated development environments. Organisations adopting MCP-based tools should consider the security of the entire integration, including the server implementation, input validation and permissions available to connected agents. For enterprises, this could mean adding MCP server version checks to software inventory processes and including agent-connected developer tools in vulnerability management programmes. These are broader security considerations, rather than additional capabilities or requirements announced by AWS. ## AWS Acknowledges Security Researcher AWS credited **Syed Anas Mohiuddin** for collaborating on the vulnerability through its coordinated vulnerability disclosure process. The bulletin references two additional records: - CVE-2026-116635 in the CVE database. - GHSA-r6mm-377j-qg8m in GitHub Security Advisories. AWS has not disclosed additional details about exploitation, affected customer numbers or specific incidents associated with this vulnerability. ## Conclusion CVE-2026-116635 highlights the importance of securing file-system operations in AI-integrated developer tools. The path traversal weakness in the AWS Serverless MCP Server could allow an actor influencing an MCP agent to read JSON files outside the intended deployment status directory or, where write access is enabled, create or overwrite files outside that location. AWS has addressed the issue in version v0.2.1 and confirmed that no workarounds are available. Organisations using affected versions should prioritise upgrading and ensure that any forked or derivative implementations incorporate the security fix. ## Original source https://aws.amazon.com/security/security-bulletins/2026-164-aws/ ## Tags `#AWSSecurity` · `#CVE2026116635` · `#ServerlessMCP` · `#AIAgentSecurity` · `#PathTraversal` · `#VulnerabilityManagement` · `#CloudSecurity` · `#ModelContextProtocol` --- ## About this content This Markdown news article is the citation-grade twin of [AWS Discloses Path Traversal Vulnerability in Serverless MCP Server, Urges Upgrade to v0.2.1](https://www.xcademia.com/news/aws-discloses-path-traversal-vulnerability-in-serverless-mcp-server-urges-upgrade-to-v0-2-1). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/aws-discloses-path-traversal-vulnerability-in-serverless-mcp-server-urges-upgrade-to-v0-2-1 - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt