AWS Serverless MCP Server CVE-2026-116635

Exploitation requires the attacker to control or influence the serverless project-name input processed by the MCP agent's deployment status component, supplying either a relative path with directory traversal sequences (../) or an absolute path, where the resolved path must end in a valid JSON file. Read-out of arbitrary JSON files is possible in the default configuration (the file contents are returned into the agent's context). Create/overwrite of JSON files outside the intended directory is additionally possible ONLY when the server is run with the non-default --enable-write flag. Limiting factors: the attack is local-vector with required interaction (the agent must process the tainted input), the target path is constrained to valid JSON files, write impact is confined to overwriting files with serverless deployment metadata, and all versions before v0.2.1 are affected. There is no workaround per the vendor; upgrading to v0.2.1 is the only fix.

This is a moderate-severity path traversal (CWE-23/CWE-36) rated CVSS 6.1 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. The CVSS attack vector is Local (AV:L) and requires user interaction (UI:R), reflecting that exploitation is not a direct remote-network event but occurs when the MCP agent processes an attacker-influenced project-name input rather than a standalone network request. The signals are consistent and point to a real-but-bounded issue rather than an overstated high-CVSS finding: the vuln.today Decision label is 'this_month' (not act_now/emergency), there is no CISA KEV listing, and no EPSS score was supplied in the input, so widespread automated exploitation is not indicated. No public exploit was identified at the time of analysis - the only references are the AWS security bulletin and the awslabs GHSA advisory, which are advisories, not exploit code. The impact is asymmetric: confidentiality is rated High (C:H) because arbitrary JSON files outside the deployment-status directory can be read back into the agent's context, while integrity is only Low (I:L) and availability None (A:N) because write/overwrite is limited to JSON files, is gated behind the non-default --enable-write flag, and clobbers files with serverless deployment metadata. Net: a legitimate same-month patching priority driven by the confidentiality exposure and data-exfiltration-into-agent-context risk, but not an emergency given local vector, required interaction, niche product footprint, and absence of KEV/known exploitation.

An attacker who can influence the project-name input handed to the AWS Serverless MCP Server (for example via a third-party-controlled project specification the AI agent ingests) supplies a value containing directory traversal sequences (../) or an absolute path ending in a valid JSON file. When the agent queries deployment status, the server resolves the attacker-controlled path and returns the contents of that out-of-directory JSON file into the agent's context, enabling exfiltration of sensitive data; if the server was started with --enable-write, the same input can create or overwrite JSON files outside the intended directory. No public exploit code was identified at the time of analysis.