What happened
The deployment-status component of the AWS Serverless MCP Server does not restrict a pathname to its intended directory. A prompt-injection-influenced agent or an untrusted request can pass traversal sequences or an absolute path in the project name to read (and optionally write) JSON files outside the expected directory. CVSS 6.1 (3.1), published 2026-11-02.
Why it matters
This is an MCP tool that an LLM agent calls to manage serverless deployments. Since the input is attacker/agent-controlled, it gives a prompt-injected or malicious agent a way to read sensitive JSON (e.g. deployment/config/credential-bearing files) on the host, or overwrite files if write is enabled — an agentic path-traversal that crosses the agent-to-host boundary.
Attack vector
A pathname is not restricted to the intended deployment-status directory. An actor who can influence the MCP agent supplies directory-traversal sequences or an absolute path in the project-name input, allowing the component to read JSON files outside the directory (and, with write access enabled, create or overwrite them).
Affected systems
awslabs.aws-serverless-mcp-server before v0.2.1
Mitigation
Upgrade to aws-serverless-mcp-server v0.2.1. Advisory: https://aws.amazon.com/security/security-bulletins/2026-164-aws/ and GHSA-r6mm-377j-qg8m