Package vulnerability, severity medium

AWS Serverless MCP Server path traversal in deployment status component (CVE-2026-116635)

Published November 2, 2026

Improper limitation of a pathname in the deployment status component of the AWS Serverless MCP Server could let an actor who can influence the MCP agent read JSON files outside the intended directory. Where write access is enabled, they could also create or overwrite JSON files outside that directory. The issue is reachable through directory traversal sequences or an absolute path in the project name input, and is fixed in version 0.2.1.

What's affected

• awslabs.aws-serverless-mcp-server (pypi)<0.2.1

What to do

1. Upgrade awslabs.aws-serverless-mcp-server to version 0.2.1 or later
2. Patch any forked or derivative code to incorporate the fix
3. No workarounds are available

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident aws-serverless-mcp-server-path-traversal-2026-11

References

• https://aws.amazon.com/security/security-bulletins/rss/2026-164-aws/

Notice aws-serverless-mcp-server-path-traversal-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.