al-ice.ai

Project Name Was a Path: CVE-2026-116635 Traversal Reaches Outside the AWS Serverless MCP Deployment Directory

AI Vulnerabilities & CVEs by al-ice.ai Editorial

NVD published CVE-2026-116635 on 2 November 2026, scoring it CVSS 3.1 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N; CVSS 4.0 6.9) under CWE-23 and CWE-36. The target is the AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server), the awslabs Model Context Protocol server for serverless workflows: its deployment status component built file paths from the project name input without constraining them to the intended deployment status directory. An actor who can influence the MCP agent — note the phrasing, which puts model output in the attacker’s seat — can supply directory traversal sequences or an absolute path and thereby read JSON files outside the directory; where write access has been enabled, the same input can create or overwrite JSON files outside it. The fix is version 0.2.1, referenced alongside AWS security bulletin 2026-164-AWS and advisory GHSA-r6mm-377j-qg8m.

A filename input with no directory leash

The NVD description is unusually complete about the mechanics, and the shape is the oldest one in the book: an input labeled “name” is concatenated into a filesystem path and never re-anchored. ../../ sequences walk out of the status directory; an absolute path ignores it entirely. Read impact is rated High on confidentiality because deployment-status JSON sits adjacent to whatever else the server process can see — configuration, neighboring project metadata, anything the OS user may read. The write half is conditional (“where write access has been enabled”) but strictly worse: creating or overwriting JSON outside the directory turns a status reporter into a file drop, with integrity impact that depends on what consumes those files downstream.

The CVSS vector deserves a careful read rather than a dismissal. AV:L with user interaction required looks modest until you place it in the MCP threat model this site has documented all season: the “user” whose interaction is required is frequently an agent operator approving a routine deployment-status check, and the “actor who can influence the MCP agent” can be a prompt injection upstream of that approval. The same indirection carried the AWS MCP run_script sandbox escape, where match/case AST-blindness let hostile input through, and the AWS API MCP audience-validation bypass, where a missing token check let local users run AWS operations. Three AWS MCP flaws in as many weeks, each in a different component, each reachable through the agent rather than around it — that is a pattern in the development of these servers, not a streak of bad luck. The Network-AI triple traversal batch fixed in 5.15.5 shows the same filename-into-path habit elsewhere in agent tooling.

The fix, and the audit it implies

Remediation per NVD is a one-liner: upgrade to 0.2.1. We confirmed the fixed release is current on PyPI under awslabs.aws-serverless-mcp-server. The implied audit is the standard traversal follow-up: canonicalize the resolved path and verify it stays inside the status directory (or reject anything that is not a bare project identifier) on every code path that builds status paths — and, separately, reconsider whether the deployment status component needs write access at all, since the write primitive is what converts disclosure into persistence-adjacent impact. As of 3 November, tracker mirrors show the CVE as disclosed with no KEV listing; the write condition and the influence-the-agent precondition bound realistic exploitation, but neither is a control.

What to actually do

  1. Upgrade to awslabs.aws-serverless-mcp-server ≥ 0.2.1. If the server’s deployment status tools are exposed to agents that process untrusted content, treat this as the top of the queue.
  2. Constrain the blast radius regardless of version: run the server with write access disabled unless deployment writes are required, and scope the OS user’s readable directories to what status reporting legitimately needs.
  3. Review which principals and which model output can reach the project name input — any prompt-injectable path into that parameter is the delivery route.
  4. Watch for the follow-on class across sibling MCP servers: filename-into-path construction in status, log and artifact components, the same habit behind the Network-AI batch.

Our verification was read-only. We read the NVD JSON record for CVE-2026-116635 first-hand (published 2 November 2026; CVSS 3.1 6.1 with the vector quoted above; CVSS 4.0 6.9; CWE-23 and CWE-36; affected before 0.2.1; remediation to 0.2.1; references to AWS bulletin 2026-164-AWS, GHSA-r6mm-377j-qg8m and the PyPI 0.2.1 release) and confirmed the 0.2.1 release via the PyPI JSON API. The AWS bulletin page content is JavaScript-rendered and was confirmed by title reference only; the GitHub advisory page returned 404 to unauthenticated requests and is cited via the NVD reference without a first-hand read, consistent with our standing handling of that wall. Tracker state (no KEV listing as of 3 November) is attributed to secondary mirrors. We installed nothing, ran no MCP server and crafted no traversal. Brave Search was used for discovery only.

Sources: