MCP server CVEs, November: AWS Serverless MCP path traversal (CVE-2026-116635), Instatic row authorization (CVE-2026-121458), Trawl SSRF (CVE-2026-122140); all fixed

View raw markdownEdit on GitHub ↗

TL;DR

Two MCP-server records this week, both fixed. AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server, PyPI) before 0.2.1 built a file path from the serverless project name, so "an actor who can influence the MCP agent" could make the deployment-status tool read JSON files outside its directory, or with --enable-write create and overwrite them (CVE-2026-116635, AWS bulletin 2026-164, CVSS 3.1 6.1 and 4.0 6.9, local, user interaction; fixed 0.2.1 on 2026-10-30, "No workarounds are available"). Instatic, a content management system with AI chat and MCP tools, let a low-privileged user with ai.chat and content.edit.own call content_get_document and content_list_documents over MCP without the object-level checks the HTTP API enforces, reading other users' private drafts and rows from the posts system table (CVE-2026-121458, VulnCheck, CVSS 4.0 7.1 and 3.1 6.5; fixed 0.0.21, release page dated 12 Oct with no year shown). AWS also issued CVE-2026-120497 for a stored XSS in the removed aidlc-traceability CLI's HTML reports. Upgrade, and treat every MCP tool as a second API that needs the same authorization as the first.

What happened

AWS Serverless MCP Server, CVE-2026-116635. AWS's bulletin 2026-164 (2026-11-02 13:30 PST, Important) and the awslabs/mcp vendor advisory GHSA-r6mm-377j-qg8m (published 2026-11-02, Moderate, CWE-23 and CWE-36) describe the deployment status component: it "does not properly restrict file paths derived from the serverless project name", so a project name containing traversal sequences or an absolute path points at JSON files outside the intended deployment-status directory. "Reads return file contents to the agent's context, and writes can clobber deployment metadata" when the server runs with the --enable-write flag. The CVE record (AWS CNA, published 2026-11-02 21:34 UTC) scores it 6.1 on CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and 6.9 on 4.0: local, no privileges, user interaction, high confidentiality. The attacker in that vector is the content the agent reads, which is prompt injection in the corpus's terms: a project name is exactly the kind of string a model copies from a README, an issue or a chat. PyPI published 0.2.1 on 2026-10-30 20:56 UTC, three days before the bulletin; 0.2.0 dates from 2026-08-26 and the affected range is "before v0.2.1", every prior release. The bulletin credits Syed Anas Mohiuddin; the advisory credits Se Hoon (bebold6133). This is the awslabs/mcp monorepo whose other servers appear in the October batch and whose bulletins arrive at a rate of about one a week.

Instatic, CVE-2026-121458. VulnCheck's record (published 2026-11-03 12:59 UTC) and the vendor advisory GHSA-x5cc-8486-8qqx (CoreBunch/Instatic, published 2026-11-03, Moderate, CVSS 3.1 6.5) describe "a missing authorization vulnerability in its AI/MCP content read tools": a user with ai.chat and content.edit.own capabilities calls content_get_document and content_list_documents "without the object-level authorization checks enforced by the normal HTTP API", retrieving other users' private or unpublished drafts and enumerating rows from the posts system table. VulnCheck adds a CVSS 4.0 of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H); the vendor page prints only the 3.1 score. The affected range is 0.0.12 before 0.0.21. The fix release v0.0.21 (GitHub release dated 12 Oct, year not shown) lists it among access-control items ("read tools and the MCP relay decide row access with the HTTP rules") with no security wording, no GHSA and no CVE, so the advisory published three weeks after the release. The artifact is a container image, ghcr.io/corebunch/instatic; there is no registry package. Instatic is small and the record matters as a shape: an MCP tool that reads the database with its own query, next to an HTTP API with per-row checks, is a second API with no checks.

aidlc-traceability, CVE-2026-120497. AWS bulletin 2026-163 (2026-11-02 11:00 PST) and the CVE record (AWS CNA): a stored cross-site scripting bug in the HTML report generator of the aidlc-traceability CLI in AWS AI-DLC Workflows, where crafted artifact titles or descriptions run script in the browser of whoever opens the generated traceability report (CVSS 3.1 5.0, 4.0 4.6). The affected range is every copy before commit 96cf0ea of 2026-07-03; the CLI was removed from awslabs/aidlc-workflows on 2026-07-16 and a re-implementation lives at aws-samples/sample-aidlc-traceability. Remediation is to delete copies obtained before 2026-07-03 or update to the commit, and meanwhile not to open HTML reports from untrusted projects. It is here because AI-DLC is AWS's agent-driven development workflow and a CLI that was deleted four months ago still runs on the machines that cloned it.

Am I affected?

pip show awslabs.aws-serverless-mcp-server 2>/dev/null | grep -E '^Version'   # < 0.2.1: affected
grep -rn 'aws-serverless-mcp-server' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null   # where it is configured
grep -rn 'enable-write' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null                # write path enabled
docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -i 'corebunch/instatic'   # Instatic: tag < 0.0.21
ls -d ~/aidlc-workflows*/ */aidlc-traceability* 2>/dev/null                                      # old AI-DLC clones
  • A uvx awslabs.aws-serverless-mcp-server@latest entry resolves to 0.2.1 on each start since 2026-10-30; a pinned version or a cached environment does not.
  • For Instatic, the exposure requires a user with ai.chat and the MCP tools reachable; a single-author site has no second user to read.

If you are affected

  • Upgrade awslabs.aws-serverless-mcp-server to 0.2.1 and restart every MCP client that spawns it. If --enable-write was on, review the deployment-status directory's parent for JSON files changed since the server was first run, and the agent transcripts for project names containing ../ or a leading /.
  • Upgrade Instatic to 0.0.21 and audit which drafts were read through the AI chat by users who could not have read them in the admin UI.
  • Delete pre-2026-07-03 copies of aidlc-traceability.
  • See if an MCP server was malicious for the transcript and configuration audit, which applies to a vulnerable server as well.

Prevention

  • Run MCP servers with the narrowest flags; --enable-write turned a read into an overwrite here. See MCP hygiene.
  • Apply the HTTP API's authorization to every MCP tool that reads the same data, in the same code path, not in a parallel implementation.
  • Keep the awslabs/mcp advisories tab and the AWS security-bulletin index in the weekly review; the records land on the bulletin index days after the PyPI fix.

Update 2026-11-05: Trawl 1.5.0 through 1.9.3, the MCP outbound-URL policy classed IPv4-mapped IPv6 loopback and private addresses as public (CVE-2026-122140, fixed 1.10.0)

Trawl is a self-hosted scraping service for applications and AI agents (1.1k GitHub stars, distributed as the ghcr.io/germondai/trawl image; the JavaScript client is not on npm) that, with MCP_ENABLED=true, exposes a Streamable HTTP MCP endpoint at /mcp with read, scrape, extract, screenshot and inspect tools. The vendor advisory GHSA-mj45-84p2-v77q (2026-11-03, Moderate, CVSS 3.1 5.3, credit Leardian) says the MCP public-destination filter recognised only the dotted-decimal form of IPv4-mapped IPv6 addresses, so the hexadecimal form (::ffff:7f00:1 for loopback, per the CNA record) was treated as public and a caller, directly or through a redirect from an allowed page, could reach loopback, private-range and cloud metadata destinations and read the responses. The native API's access to private targets is a separate, intentional operator capability and is not the bug. VulnCheck's CVE-2026-122140 (2026-11-04 20:36 UTC, CVSS 4.0 6.3, CVSS 3.1 5.8, CWE-918) states the range as 1.5.0 before 1.10.0, which matches the vendor's 1.5.0 through 1.9.3.

The fix in 1.10.0 (GitHub release 03 Nov, year not shown) replaces text-based IPv6 checks with numeric subnet checks and pins public destination IPs at connection time for HTTP and browser traffic, including through upstream proxies; MCP connections get their own clearance cache, and the release requires operators to recreate MCP sessions with publicOnly: true and to use an upstream proxy that supports literal-IP CONNECT. The release notes do not use the words SSRF or IPv6.

Why it is in this batch: an agent that scrapes through Trawl's MCP endpoint hands the server a URL the model chose, and on a cloud host the metadata service is the credential store that URL can reach. This is the RAG-ingestion and fetch-tool SSRF shape with an address-normalisation bypass instead of a parser discrepancy. Check: docker image ls | grep trawl for the tag; anything 1.5.0 through 1.9.3 with MCP enabled is affected; upgrade to 1.10.0 and follow the release's session migration, and rotate the instance's cloud credentials if the MCP endpoint was reachable by untrusted agents or users.

Update 2026-11-10: six more records, all fixed months before the ids: fast-agent serve (CVE-2026-102610), Code Graph RAG (CVE-2026-77604, CVE-2026-87008), tsParticles MCP server (three denial-of-service ids)

Six GitHub CNA records published between 2026-11-04 and 2026-11-06 reached the advisory database's mcp listing on 2026-11-09. Every one is for a fix that was on the registry by 2026-08-10. The fast-agent and Code Graph RAG vendor advisories are dated July and August; the tsParticles vendor pages were not opened, and their fixes are on npm from 2026-07-01 and 2026-07-10. They are database arrivals, not new disclosures.

Package CVE What Affected (CNA) Fix on registry Vendor advisory CNA score
fast-agent-mcp (PyPI) CVE-2026-102610 fast-agent serve listened on 0.0.0.0:8000 over HTTP with no authentication and no warning; with --shell any caller that reaches the port runs commands as the server user < 0.7.21 0.7.21, 2026-06-19 GHSA-9vhv-g5hf-m7m7, 2026-07-22 CVSS 3.1 6.4
code-graph-rag (PyPI) CVE-2026-77604 the MCP read_file tool skipped the project-root check when offset or limit was set, so an absolute path read any file; the HTTP transport bound 0.0.0.0:8080 with no authentication by default < 0.0.345 0.0.345, 2026-07-14 GHSA-vvr2-h2jp-838m, 2026-07-14 CVSS 3.1 7.5
code-graph-rag (PyPI) CVE-2026-87008 structural_search and structural_replace checked paths without resolving symlinks, so a symlink in an analysed repository reads or overwrites files outside the root < 0.0.589 0.0.589, 2026-08-10 GHSA-85gg-2gfq-q95m, 2026-08-10 CVSS 3.1 7.1
@tsparticles/mcp-server (npm) CVE-2026-63655 unbounded request-body buffering in HTTP mode < 4.3.1 4.3.1, 2026-07-01 GHSA-447x-qqwf-m7xq CVSS 3.1 7.5
@tsparticles/mcp-server (npm) CVE-2026-76892 a malformed JSON request ends the HTTP process < 4.3.1 4.3.1, 2026-07-01 GHSA-4p8p-pjpq-2w7h CVSS 4.0 8.7
@tsparticles/mcp-server (npm) CVE-2026-76893 one anonymous session can hold HTTP mode and deny new clients < 4.3.2 4.3.2, 2026-07-10 GHSA-h7c4-q426-7jh9 CVSS 4.0 6.9

fast-agent. The vendor scored it Moderate with high privileges and user interaction required (AV:N/AC:H/PR:H/UI:R), while its own summary says "Any host that can reach the port can call the exposed agent tool" and the reporter left the rating to the maintainers. Both are printed; for an operator who ran fast-agent serve --shell on a host with a routable address, the summary is the accurate description. Without --shell the exposure is unauthenticated use of the operator's model account and configured MCP tools. PyPI's newest is 0.10.53. Anything from 0.7.21 carries the fix. The fix predates the vendor advisory by five weeks.

Code Graph RAG, a version the registry does not have. The database row for CVE-2026-87008 prints affected <= 0.0.586 and patched 0.0.587. PyPI has no 0.0.587: the versions on either side are 0.0.584 (2026-08-09) and 0.0.589 (2026-08-10), and the CNA record says < 0.0.589 and references the v0.0.589 release. Use 0.0.589 or later. pip install code-graph-rag==0.0.587 fails. PyPI's newest is 0.6.30. The symlink bug needs a repository the attacker prepared and a user or agent that runs the structural tools on it; the read_file bug needed only network reach to the default HTTP transport.

tsParticles. Three availability bugs in an MCP server's HTTP mode. They are listed for completeness and carry no data exposure in the records. npm's newest is 4.5.3 (2026-11-06). The CNA lists two products (tsparticles and mcp-server) for each id; the npm package is @tsparticles/mcp-server.

Check. pip show fast-agent-mcp code-graph-rag 2>/dev/null | grep -E "^(Name|Version)" and npm ls @tsparticles/mcp-server. For the two Python servers, also check how they are started: any serve or mcp-server process bound to 0.0.0.0 on a machine with a routable address should move to 127.0.0.1 or behind authentication whatever the version. If a pre-fix code-graph-rag or fast-agent serve --shell was reachable from an untrusted network, rotate the credentials readable by that user; if your local AI agent was exploited has the steps.

Sources