AWS has disclosed CVE-2026-116635 in the AWS Serverless MCP Server, the open-source MCP server from awslabs/mcp that helps agents build and deploy serverless apps. Versions before 0.2.1 of awslabs.aws-serverless-mcp-server are affected. The fix went to PyPI on 30 October and the advisory followed on 2 November.
The bug
The server’s deployment status component builds a file path from the serverless project name. It did not stop names containing ../ or an absolute path. Anyone who can influence what the agent sends, for example through text the agent reads, could make it pass such a name and:
- read a JSON file outside the deployment status folder, which then lands in the agent’s context;
- with the server started with
--enable-write, create or overwrite a JSON file elsewhere with deployment metadata.
GitHub rates it moderate; AWS lists the bulletin as important. AWS says there is no workaround and asks anyone running a fork or derivative to apply the fix too. No exploitation has been reported.
What to do
Check the installed version of awslabs.aws-serverless-mcp-server in each MCP client config and move to 0.2.1 or later. While you are there, see whether --enable-write is set and drop it for agents that only need to read.
Why this matters
The input here is a tool argument, not a prompt, which is the point: anything an agent passes to a tool can be steered by content the agent read earlier. MCP servers that touch files need the same path checks as any web handler, and a second line of defense in read-only defaults. It is the same lesson as the MCP Inspector advisories last month, at a smaller scale.
The Campfire
CommentsThanks. Your comment is waiting for the desk. Once it is approved it appears here within about a minute.
Add a comment