CVE-2026-116635 in Serverless MCP Server
Summary
by MITRE • 11/02/2026
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
To remediate this issue, users should upgrade to version v0.2.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified as Improper Limitation of a Pathname to a Restricted Directory within the AWS Serverless MCP Server prior to version 0.2.1 represents a critical security flaw rooted in insufficient input validation and path canonicalization logic. This defect resides specifically within the deployment status component, which is responsible for managing project configurations and state files stored as JSON documents. The core technical failure occurs when the application accepts user-supplied input for the project name without adequately sanitizing directory traversal sequences or absolute paths. By exploiting this weakness, an attacker who has the ability to influence the Model Context Protocol agent can manipulate file system operations to access resources outside of the intended sandboxed deployment status directory. This lack of strict boundary enforcement allows the application to resolve relative path components such as dot-dot-slash sequences or direct absolute references, effectively bypassing the security controls designed to isolate project data from the rest of the server environment.
The operational impact of this vulnerability is severe due to its potential for both information disclosure and unauthorized modification of system files. In scenarios where read access permissions are active on the target directory structure, an adversary can leverage path traversal techniques to extract sensitive JSON configuration files that may contain API keys, database credentials, or other proprietary secrets stored outside the designated project folder. Furthermore, if write access has been enabled for the deployment status component, the vulnerability escalates into a critical integrity risk. An attacker can craft malicious inputs to create new files or overwrite existing ones in arbitrary locations on the file system. This capability enables persistent backdoor installation, configuration tampering, or denial of service through resource exhaustion, fundamentally compromising the confidentiality and integrity of the serverless application infrastructure managed by the MCP Server.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file names that could cause unintended navigation across restricted directories or drives. Additionally, the exploitation vector relates to ATT&CK technique T1564.008 Hidden Files and Directories if used for persistence, or more directly T1083 File and Directory Discovery when utilized for reconnaissance of sensitive configuration files. The attack pattern typically involves injecting encoded traversal sequences into the project name parameter during deployment status initialization or update operations, causing the underlying file system API to resolve paths incorrectly and access unauthorized locations.
To mitigate this risk effectively, organizations must prioritize immediate patching by upgrading the AWS Serverless MCP Server to version 0.2.1 or later, where these path validation checks have been corrected. In addition to software updates, defensive measures should include implementing strict allow-lists for project name inputs that reject any characters indicative of directory traversal such as periods and slashes unless explicitly required for valid alphanumeric naming conventions. Principle of least privilege must be enforced by ensuring the application process runs with minimal file system permissions, restricting write access only to specific directories where it is absolutely necessary. Regular security audits focusing on input validation logic in components handling user-supplied paths are essential to prevent similar vulnerabilities from being introduced during future development cycles.