--- id: 2026-11-mcp-server-november-cve-batch-aws-serverless-mcp-server-path-traversal-instatic-mcp-authorization title: "MCP server CVEs, November: AWS Serverless MCP Server project-name path traversal (CVE-2026-116635, fixed 0.2.1); Instatic MCP read tools skip row authorization (CVE-2026-121458, fixed 0.0.21)" date_disclosed: 2026-11-02 last_updated: 2026-11-03 severity: medium status: patched ecosystems: [mcp, pypi, aws, awslabs, cms] tools_affected: ["awslabs.aws-serverless-mcp-server (PyPI) before 0.2.1, worse with --enable-write", "Instatic CMS 0.0.12 before 0.0.21 (ghcr.io/corebunch/instatic) with the AI/MCP content tools enabled", "aidlc-traceability CLI copies obtained from awslabs/aidlc-workflows before 2026-07-03"] tags: [cve, ghsa, mcp, mcp-server, path-traversal, aws, awslabs-mcp, authorization, idor, cms, aws-security-bulletin, vulncheck, xss, agentic-workflows] --- ## TL;DR Two MCP-server records this week, both fixed. **AWS Serverless MCP Server** (`awslabs.aws-serverless-mcp-server`, PyPI) before 0.2.1 built a file path from the serverless project name, so "an actor who can influence the MCP agent" could make the deployment-status tool read JSON files outside its directory, or with `--enable-write` create and overwrite them (CVE-2026-116635, AWS bulletin 2026-164, CVSS 3.1 6.1 and 4.0 6.9, local, user interaction; fixed 0.2.1 on 2026-10-30, "No workarounds are available"). **Instatic**, a content management system with AI chat and MCP tools, let a low-privileged user with `ai.chat` and `content.edit.own` call `content_get_document` and `content_list_documents` over MCP without the object-level checks the HTTP API enforces, reading other users' private drafts and rows from the posts system table (CVE-2026-121458, VulnCheck, CVSS 4.0 7.1 and 3.1 6.5; fixed 0.0.21, release page dated 12 Oct with no year shown). AWS also issued CVE-2026-120497 for a stored XSS in the removed `aidlc-traceability` CLI's HTML reports. Upgrade, and treat every MCP tool as a second API that needs the same authorization as the first. ## What happened **AWS Serverless MCP Server, CVE-2026-116635.** AWS's bulletin 2026-164 (2026-11-02 13:30 PST, Important) and the awslabs/mcp vendor advisory GHSA-r6mm-377j-qg8m (published 2026-11-02, Moderate, CWE-23 and CWE-36) describe the deployment status component: it "does not properly restrict file paths derived from the serverless project name", so a project name containing traversal sequences or an absolute path points at JSON files outside the intended deployment-status directory. "Reads return file contents to the agent's context, and writes can clobber deployment metadata" when the server runs with the `--enable-write` flag. The CVE record (AWS CNA, published 2026-11-02 21:34 UTC) scores it 6.1 on CVSS 3.1 (`AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`) and 6.9 on 4.0: local, no privileges, user interaction, high confidentiality. The attacker in that vector is the content the agent reads, which is prompt injection in the corpus's terms: a project name is exactly the kind of string a model copies from a README, an issue or a chat. PyPI published 0.2.1 on 2026-10-30 20:56 UTC, three days before the bulletin; 0.2.0 dates from 2026-08-26 and the affected range is "before v0.2.1", every prior release. The bulletin credits Syed Anas Mohiuddin; the advisory credits Se Hoon (bebold6133). This is the awslabs/mcp monorepo whose other servers appear in [the October batch](2026-10-mcp-server-october-cve-batch-obsidian-tc-cloud-run-mcp-toolbox-aws-mcp-server-mcp-from-openapi.md) and whose bulletins arrive at a rate of about one a week. **Instatic, CVE-2026-121458.** VulnCheck's record (published 2026-11-03 12:59 UTC) and the vendor advisory GHSA-x5cc-8486-8qqx (CoreBunch/Instatic, published 2026-11-03, Moderate, CVSS 3.1 6.5) describe "a missing authorization vulnerability in its AI/MCP content read tools": a user with `ai.chat` and `content.edit.own` capabilities calls `content_get_document` and `content_list_documents` "without the object-level authorization checks enforced by the normal HTTP API", retrieving other users' private or unpublished drafts and enumerating rows from the posts system table. VulnCheck adds a CVSS 4.0 of 7.1 (`AV:N/AC:L/AT:N/PR:L/UI:N/VC:H`); the vendor page prints only the 3.1 score. The affected range is 0.0.12 before 0.0.21. The fix release v0.0.21 (GitHub release dated 12 Oct, year not shown) lists it among access-control items ("read tools and the MCP relay decide row access with the HTTP rules") with no security wording, no GHSA and no CVE, so the advisory published three weeks after the release. The artifact is a container image, `ghcr.io/corebunch/instatic`; there is no registry package. Instatic is small and the record matters as a shape: an MCP tool that reads the database with its own query, next to an HTTP API with per-row checks, is a second API with no checks. **aidlc-traceability, CVE-2026-120497.** AWS bulletin 2026-163 (2026-11-02 11:00 PST) and the CVE record (AWS CNA): a stored cross-site scripting bug in the HTML report generator of the `aidlc-traceability` CLI in AWS AI-DLC Workflows, where crafted artifact titles or descriptions run script in the browser of whoever opens the generated traceability report (CVSS 3.1 5.0, 4.0 4.6). The affected range is every copy before commit `96cf0ea` of 2026-07-03; the CLI was removed from `awslabs/aidlc-workflows` on 2026-07-16 and a re-implementation lives at `aws-samples/sample-aidlc-traceability`. Remediation is to delete copies obtained before 2026-07-03 or update to the commit, and meanwhile not to open HTML reports from untrusted projects. It is here because AI-DLC is AWS's agent-driven development workflow and a CLI that was deleted four months ago still runs on the machines that cloned it. ## Am I affected? ```bash pip show awslabs.aws-serverless-mcp-server 2>/dev/null | grep -E '^Version' # < 0.2.1: affected grep -rn 'aws-serverless-mcp-server' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null # where it is configured grep -rn 'enable-write' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null # write path enabled docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -i 'corebunch/instatic' # Instatic: tag < 0.0.21 ls -d ~/aidlc-workflows*/ */aidlc-traceability* 2>/dev/null # old AI-DLC clones ``` - A `uvx awslabs.aws-serverless-mcp-server@latest` entry resolves to 0.2.1 on each start since 2026-10-30; a pinned version or a cached environment does not. - For Instatic, the exposure requires a user with `ai.chat` and the MCP tools reachable; a single-author site has no second user to read. ## If you are affected - Upgrade `awslabs.aws-serverless-mcp-server` to 0.2.1 and restart every MCP client that spawns it. If `--enable-write` was on, review the deployment-status directory's parent for JSON files changed since the server was first run, and the agent transcripts for project names containing `../` or a leading `/`. - Upgrade Instatic to 0.0.21 and audit which drafts were read through the AI chat by users who could not have read them in the admin UI. - Delete pre-2026-07-03 copies of `aidlc-traceability`. - See [if an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md) for the transcript and configuration audit, which applies to a vulnerable server as well. ## Prevention - Run MCP servers with the narrowest flags; `--enable-write` turned a read into an overwrite here. See [MCP hygiene](../prevention/mcp-hygiene.md). - Apply the HTTP API's authorization to every MCP tool that reads the same data, in the same code path, not in a parallel implementation. - Keep the awslabs/mcp advisories tab and the AWS security-bulletin index in the weekly review; the records land on the bulletin index days after the PyPI fix. ## Sources - [AWS Security Bulletin 2026-164-AWS](https://aws.amazon.com/security/security-bulletins/2026-164-aws/) — fetched 2026-11-03: 2026-11-02 13:30 PST, CVE-2026-116635, "< v0.2.1", "No workarounds are available", credit Syed Anas Mohiuddin. - [awslabs/mcp — GHSA-r6mm-377j-qg8m](https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m) — fetched 2026-11-03: published 2026-11-02, Moderate, CVSS 3.1 6.1, CWE-23 and CWE-36, the `--enable-write` sentence, credit bebold6133. - [CVE Services — CVE-2026-116635](https://cveawg.mitre.org/api/cve/CVE-2026-116635) — fetched 2026-11-03: AWS CNA, published 2026-11-02 21:34 UTC, affected before 0.2.1, CVSS 3.1 6.1 and 4.0 6.9 with vectors. - PyPI `awslabs.aws-serverless-mcp-server`, queried 2026-11-03: 0.2.1 uploaded 2026-10-30 20:56 UTC, 0.2.0 on 2026-08-26; `pip index versions` newest 0.2.1. - [AWS Security Bulletins index](https://aws.amazon.com/security/security-bulletins/) — fetched 2026-11-03: 2026-161 to 2026-164 dated 2026-11-02. - [CVE Services — CVE-2026-121458](https://cveawg.mitre.org/api/cve/CVE-2026-121458) — fetched 2026-11-03: VulnCheck CNA, published 2026-11-03 12:59 UTC, CoreBunch Instatic 0.0.12 before 0.0.21, CVSS 4.0 7.1 and 3.1 6.5, references to the vendor advisory, the v0.0.21 release and the VulnCheck index. - [CoreBunch/Instatic — GHSA-x5cc-8486-8qqx](https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx) — fetched 2026-11-03: published 2026-11-03, Moderate, CVSS 3.1 6.5, affected below 0.0.21, patched 0.0.21, container image `ghcr.io/corebunch/instatic`. - [CoreBunch/Instatic — release v0.0.21](https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21) — fetched 2026-11-03: released 12 Oct (year not shown), the row-access and MCP relay items, no security wording, no advisory id. - [VulnCheck — advisories index](https://www.vulncheck.com/advisories) — fetched 2026-11-03: page 1, twenty records dated 2026-11-03, the Instatic row first. - [AWS Security Bulletin 2026-163-AWS](https://aws.amazon.com/security/security-bulletins/2026-163-aws/) — fetched 2026-11-03: 2026-11-02 11:00 PST, CVE-2026-120497, ">=0.1.0 AND