AWS Serverless MCP Server used a project name to construct a local deployment-status path without adequately containing it. A crafted absolute or traversing name could address JSON files beyond the intended directory and return their contents through the tool. The maintainer advisory was published on November 2, 2026, not November 7. The caller must be…
Inspect the ClaimsCase · DiggingBeagle record
AWS Serverless MCP project names escaped the deployment-status directory
Versions below 0.2.1 accepted project names that could address JSON files outside the intended directory. Writes additionally required the server's write-enabled mode; 0.2.1 is the documented fix.
Public disclosure: Nov 2, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AWS-SERVERLESS-MCP-PATH · AWS Serverless MCP Server project name path traversal advisory
At a glance
Tool arguments become filesystem authority unless constrained at the actual MCP tool host.
Read the implicationsNo established production stolen file, arbitrary OS code execution or exposure of unrelated service data beyond the paths admitted by process privileges.
Limits and uncertaintyFull account
AWS Serverless MCP Server used a project name to construct a local deployment-status path without adequately containing it. A crafted absolute or traversing name could address JSON files beyond the intended directory and return their contents through the tool. The maintainer advisory was published on November 2, 2026, not November 7.
The caller must be able to supply the relevant tool argument to a vulnerable server, and filesystem effects remain bounded by that process's permissions. Reads can bring outside JSON data into the agent's context. Writes have an additional prerequisite: the server must run with --enable-write. The written content is deployment metadata, not unrestricted attacker-chosen file bytes.
Fix and evidence boundary
The advisory identifies versions below 0.2.1 as affected and 0.2.1 as patched. It does not document a production victim, arbitrary operating-system command execution or a universal ability to read every file format. The mechanism Claim preserves the separate read and write conditions.
The useful control boundary is path resolution inside the tool host. A model's apparently reasonable project name is not a filesystem authorization decision; accepted identifiers still require containment before access.
Mechanism and trust boundary
- 01
A caller supplies a crafted project name to a vulnerable deployment-status tool.
- 02
Path construction accepts traversal or an absolute path outside the intended status directory, subject to process filesystem permissions.
- 03
Readable JSON content can enter tool output; deployment-metadata writes additionally require --enable-write.
Claims & evidence
CLM-AWS-SERVERLESS-MCP-PATHThe maintainer advisory documents that crafted project names can address JSON files outside the intended local deployment-status directory in AWS Serverless MCP Server versions below 0.2.1. Write operations additionally require --enable-write and write deployment metadata; this does not establish arbitrary attacker-chosen file contents. Version 0.2.1 is listed as patched.supported
Basis: reported finding
- supportsAWS Serverless MCP Server project name path traversal advisoryvendor statement
GHSA-r6mm-377j-qg8m: Impact, details of status-file reads and --enable-write writes, Affected versions and Patched versions
Implications
Tool arguments become filesystem authority unless constrained at the actual MCP tool host.
Controls and mitigations
- Upgrade AWS Serverless MCP Server to at least 0.2.1 and check resolved paths remain within a dedicated local status directory.
Unknowns and contradictions
- No established production stolen file, arbitrary OS code execution or exposure of unrelated service data beyond the paths admitted by process privileges.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233