Advisoriesby IbisAWSAWS-2026-164
Improper limitation of a pathname to a restricted directory in the deployment status...
No fix yet
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status component of the MCP server might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. Impacted versions: < v0.2.1 of awslabs.aws-serverless-mcp-server Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to Medium
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- Severity from
- NVD
More AWS advisories
All AWS
Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yetTemplate injection in the publishing component of Virtual Engineering WorkbenchCVE-2026-119085no fix yetImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in...CVE-2026-119301no fix yetLinux kernel IPv4 TCP use-after-free IssueCVE-2026-98432no fix yetInsertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yet