The vulnerability allows an actor who can influence the MCP agent to use directory traversal sequences or supply an absolute path in the project name to read JSON files outside the intended deployment status directory, and when write access is enabled, to create or overwrite arbitrary JSON files. This flaw corresponds to CWE‑23 (Path Traversal) and CWE‑36 (Absolute Path Traversal). The result is potential disclosure of sensitive configuration data, accidental or intentional modification of registry files, or escape of the intended confinement of the deployment status component.

All installations of the AWS Serverless MCP Server with a version earlier than v0.2.1 are affected. The issue exists in the deployment status component before v0.2.1, meaning any pre‑0.2.1 release can be impacted.

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. An attacker must first have the ability to send a project name to the MCP agent; in environments where write access is granted, the attacker can also overwrite or create arbitrary JSON files. The attack vector is limited to the MCP agent interface, so the risk is moderate but non‑negligible in environments with untrusted clients.