CVE-2026-116635: AWS aws-serverless-mcp-server: Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless…

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server aws-serverless-mcp-server before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status...