CVE-2026-116635: AWS Serverless MCP Server path traversal in deployment status

The National Vulnerability Database (NVD) record says that before v0.2.1, the Amazon Web Services (AWS) Serverless Model Context Protocol (MCP) Server might allow an actor who can influence the MCP agent to read JavaScript Object Notation (JSON) files outside the intended deployment status directory and, where write access is enabled, to create or overwrite them; fixed in v0.2.1.

The record

Kind

Vulnerability

Source record

CVE-2026-116635: Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serv (National Vulnerability Database record)

Record published

2026-11-02

Posted here

2026-11-03

World

Software agents · Enterprise work agents

Controls concerned

Hard domain restriction C-E2; Retrieved content as data C-I1

Checked

Checked against its record on 2026-11-03 by a reader who did not draft it; report verification/reports/SIG-2026-11-03-003-2026-11-03.md.

A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.

Corrections

Changes to what this signal says, with the reason. Every earlier version is kept.

• 2026-11-03: Summary. Plain-language rule: abbreviations AWS and JSON spelled out at first use; no claim changed (NVD record CVE-2026-116635). Found by the independent reader of 3 November 2026.
  Show the change

  Before: The National Vulnerability Database (NVD) record says that before v0.2.1, the AWS Serverless Model Context Protocol (MCP) Server might allow an actor who can influence the MCP agent to read JSON files outside the intended deployment status directory and, where write access is enabled, to create or overwrite them; fixed in v0.2.1.

  After: The National Vulnerability Database (NVD) record says that before v0.2.1, the Amazon Web Services (AWS) Serverless Model Context Protocol (MCP) Server might allow an actor who can influence the MCP agent to read JavaScript Object Notation (JSON) files outside the intended deployment status directory and, where write access is enabled, to create or overwrite them; fixed in v0.2.1.

What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.

Newer: Department of Transportation proposes a Privacy Act system of records for beyond visual line of sight drone operations (Parts 108/146)
Older: GHSA-j656-3hf2-fvjc: DBHub read-only mode bypass on MySQL and MariaDB