CVE-2026-116635

MediumCVSS 6.1/10Last modified Nov 6, 2026

Description

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.

To remediate this issue, users should upgrade to version v0.2.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-23 CWE-36

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
AWS	aws-serverless-mcp-server	< 0.2.1

References

Timeline

Published: Nov 2, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1166387.5The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administ CVE-2026-1166393.5A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected i CVE-2026-116648.8Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2026-1166403.5A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee CVE-2026-1166416.8The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 CVE-2026-1166457.1LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export CVE-2026-1166464.3Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.CVE-2026-1166477.1Tanium addressed an improper output sanitization vulnerability in Comply.CVE-2026-1166484.1Tanium addressed an improper output sanitization vulnerability in Discover.CVE-2026-1166497.1Tanium addressed an improper output sanitization vulnerability in Enforce.CVE-2026-116654.3Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a cra CVE-2026-1166508.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.