AWS Serverless MCP Server: Path traversal in deployment status component
Summary
The deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 does not properly restrict file paths to the intended directory. An actor who can influence the MCP agent, for example through a crafted project name containing traversal sequences or an absolute path, can read JSON files outside that directory. If write access has been enabled, the actor can also create or overwrite JSON files there, including deployment metadata. Exploitation requires local access and user interaction.
Affected
- awslabs.aws-serverless-mcp-server (PyPI) versions below v0.2.1
- Earliest affected version: Unknown.
Fixed in
- Version v0.2.1 of awslabs.aws-serverless-mcp-server. Forked or derivative code must also be patched.
Workaround
- No vendor workaround is available.
- Keep write mode disabled unless it is required.
- Limit the projects the agent may access and run the server with a low-privilege account.
- Treat agent-supplied project names as untrusted until v0.2.1 is installed.
Exploitation
- No known exploitation in the wild. The CVE is not listed in CISA KEV.
- No public exploit code is known at the time of analysis. This status is provisional, as the CVE was published on 2 Nov 2026.
Our recommendation
- Upgrade awslabs.aws-serverless-mcp-server to v0.2.1 or later and pin the version.
- Check developer workstations and forked code for affected installations.
- Verify how the MCP server is launched and whether untrusted input can reach the agent.
- Re-check the vendor advisory, as the CVE is newly published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-164-AWS aws.amazon.com
- GitHub Security Advisory GHSA-r6mm-377j-qg8m github.com
- PyPI release awslabs.aws-serverless-mcp-server 0.2.1 pypi.org
- VulDB entry 430144 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 10:51.
Original description (NVD)
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input. To remediate this issue, users should upgrade to version v0.2.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.