CVE-2026-116635

Vendor

AWS

Product

aws-serverless-mcp-server

CVSS v3.1

6.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness

CWE-23, CWE-36

Exposure class

AI infrastructure

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 40
   AWS bulletin AWS 2h ago

   CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

   Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper limitation of a pathname to a restricted directory in the deployment status…

   CVE-2026-116635 Amazon Web Services Anthropic
2. 28
   CVE NVD 1h ago

   Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server…

   Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to…

   CVSS 6.1 Fix available CVE-2026-116635 AWS