--- id: 2026-11-mcp-server-november-cve-batch-aws-serverless-mcp-server-path-traversal-instatic-mcp-authorization title: "MCP server CVEs, November: AWS Serverless MCP path traversal (CVE-2026-116635), Instatic row authorization (CVE-2026-121458), Trawl SSRF (CVE-2026-122140); all fixed" date_disclosed: 2026-11-02 last_updated: 2026-11-10 severity: medium status: patched ecosystems: [mcp, pypi, aws, awslabs, cms] tools_affected: ["awslabs.aws-serverless-mcp-server (PyPI) before 0.2.1, worse with --enable-write", "Instatic CMS 0.0.12 before 0.0.21 (ghcr.io/corebunch/instatic) with the AI/MCP content tools enabled", "aidlc-traceability CLI copies obtained from awslabs/aidlc-workflows before 2026-07-03", "Trawl 1.5.0 through 1.9.3 (ghcr.io/germondai/trawl) with MCP_ENABLED=true (CVE-2026-122140, fixed 1.10.0)", "fast-agent-mcp (PyPI) before 0.7.21 running fast-agent serve (CVE-2026-102610)", "code-graph-rag (PyPI) before 0.0.345 (CVE-2026-77604) and before 0.0.589 (CVE-2026-87008)", "@tsparticles/mcp-server (npm) before 4.3.2 in HTTP mode (three denial-of-service ids)"] tags: [cve, ghsa, mcp, mcp-server, path-traversal, aws, awslabs-mcp, authorization, idor, cms, aws-security-bulletin, vulncheck, xss, agentic-workflows] --- ## TL;DR Two MCP-server records this week, both fixed. **AWS Serverless MCP Server** (`awslabs.aws-serverless-mcp-server`, PyPI) before 0.2.1 built a file path from the serverless project name, so "an actor who can influence the MCP agent" could make the deployment-status tool read JSON files outside its directory, or with `--enable-write` create and overwrite them (CVE-2026-116635, AWS bulletin 2026-164, CVSS 3.1 6.1 and 4.0 6.9, local, user interaction; fixed 0.2.1 on 2026-10-30, "No workarounds are available"). **Instatic**, a content management system with AI chat and MCP tools, let a low-privileged user with `ai.chat` and `content.edit.own` call `content_get_document` and `content_list_documents` over MCP without the object-level checks the HTTP API enforces, reading other users' private drafts and rows from the posts system table (CVE-2026-121458, VulnCheck, CVSS 4.0 7.1 and 3.1 6.5; fixed 0.0.21, release page dated 12 Oct with no year shown). AWS also issued CVE-2026-120497 for a stored XSS in the removed `aidlc-traceability` CLI's HTML reports. Upgrade, and treat every MCP tool as a second API that needs the same authorization as the first. ## What happened **AWS Serverless MCP Server, CVE-2026-116635.** AWS's bulletin 2026-164 (2026-11-02 13:30 PST, Important) and the awslabs/mcp vendor advisory GHSA-r6mm-377j-qg8m (published 2026-11-02, Moderate, CWE-23 and CWE-36) describe the deployment status component: it "does not properly restrict file paths derived from the serverless project name", so a project name containing traversal sequences or an absolute path points at JSON files outside the intended deployment-status directory. "Reads return file contents to the agent's context, and writes can clobber deployment metadata" when the server runs with the `--enable-write` flag. The CVE record (AWS CNA, published 2026-11-02 21:34 UTC) scores it 6.1 on CVSS 3.1 (`AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`) and 6.9 on 4.0: local, no privileges, user interaction, high confidentiality. The attacker in that vector is the content the agent reads, which is prompt injection in the corpus's terms: a project name is exactly the kind of string a model copies from a README, an issue or a chat. PyPI published 0.2.1 on 2026-10-30 20:56 UTC, three days before the bulletin; 0.2.0 dates from 2026-08-26 and the affected range is "before v0.2.1", every prior release. The bulletin credits Syed Anas Mohiuddin; the advisory credits Se Hoon (bebold6133). This is the awslabs/mcp monorepo whose other servers appear in [the October batch](2026-10-mcp-server-october-cve-batch-obsidian-tc-cloud-run-mcp-toolbox-aws-mcp-server-mcp-from-openapi.md) and whose bulletins arrive at a rate of about one a week. **Instatic, CVE-2026-121458.** VulnCheck's record (published 2026-11-03 12:59 UTC) and the vendor advisory GHSA-x5cc-8486-8qqx (CoreBunch/Instatic, published 2026-11-03, Moderate, CVSS 3.1 6.5) describe "a missing authorization vulnerability in its AI/MCP content read tools": a user with `ai.chat` and `content.edit.own` capabilities calls `content_get_document` and `content_list_documents` "without the object-level authorization checks enforced by the normal HTTP API", retrieving other users' private or unpublished drafts and enumerating rows from the posts system table. VulnCheck adds a CVSS 4.0 of 7.1 (`AV:N/AC:L/AT:N/PR:L/UI:N/VC:H`); the vendor page prints only the 3.1 score. The affected range is 0.0.12 before 0.0.21. The fix release v0.0.21 (GitHub release dated 12 Oct, year not shown) lists it among access-control items ("read tools and the MCP relay decide row access with the HTTP rules") with no security wording, no GHSA and no CVE, so the advisory published three weeks after the release. The artifact is a container image, `ghcr.io/corebunch/instatic`; there is no registry package. Instatic is small and the record matters as a shape: an MCP tool that reads the database with its own query, next to an HTTP API with per-row checks, is a second API with no checks. **aidlc-traceability, CVE-2026-120497.** AWS bulletin 2026-163 (2026-11-02 11:00 PST) and the CVE record (AWS CNA): a stored cross-site scripting bug in the HTML report generator of the `aidlc-traceability` CLI in AWS AI-DLC Workflows, where crafted artifact titles or descriptions run script in the browser of whoever opens the generated traceability report (CVSS 3.1 5.0, 4.0 4.6). The affected range is every copy before commit `96cf0ea` of 2026-07-03; the CLI was removed from `awslabs/aidlc-workflows` on 2026-07-16 and a re-implementation lives at `aws-samples/sample-aidlc-traceability`. Remediation is to delete copies obtained before 2026-07-03 or update to the commit, and meanwhile not to open HTML reports from untrusted projects. It is here because AI-DLC is AWS's agent-driven development workflow and a CLI that was deleted four months ago still runs on the machines that cloned it. ## Am I affected? ```bash pip show awslabs.aws-serverless-mcp-server 2>/dev/null | grep -E '^Version' # < 0.2.1: affected grep -rn 'aws-serverless-mcp-server' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null # where it is configured grep -rn 'enable-write' ~/.cursor/mcp.json ~/.claude.json .mcp.json 2>/dev/null # write path enabled docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -i 'corebunch/instatic' # Instatic: tag < 0.0.21 ls -d ~/aidlc-workflows*/ */aidlc-traceability* 2>/dev/null # old AI-DLC clones ``` - A `uvx awslabs.aws-serverless-mcp-server@latest` entry resolves to 0.2.1 on each start since 2026-10-30; a pinned version or a cached environment does not. - For Instatic, the exposure requires a user with `ai.chat` and the MCP tools reachable; a single-author site has no second user to read. ## If you are affected - Upgrade `awslabs.aws-serverless-mcp-server` to 0.2.1 and restart every MCP client that spawns it. If `--enable-write` was on, review the deployment-status directory's parent for JSON files changed since the server was first run, and the agent transcripts for project names containing `../` or a leading `/`. - Upgrade Instatic to 0.0.21 and audit which drafts were read through the AI chat by users who could not have read them in the admin UI. - Delete pre-2026-07-03 copies of `aidlc-traceability`. - See [if an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md) for the transcript and configuration audit, which applies to a vulnerable server as well. ## Prevention - Run MCP servers with the narrowest flags; `--enable-write` turned a read into an overwrite here. See [MCP hygiene](../prevention/mcp-hygiene.md). - Apply the HTTP API's authorization to every MCP tool that reads the same data, in the same code path, not in a parallel implementation. - Keep the awslabs/mcp advisories tab and the AWS security-bulletin index in the weekly review; the records land on the bulletin index days after the PyPI fix. ## Update 2026-11-05: Trawl 1.5.0 through 1.9.3, the MCP outbound-URL policy classed IPv4-mapped IPv6 loopback and private addresses as public (CVE-2026-122140, fixed 1.10.0) Trawl is a self-hosted scraping service for applications and AI agents (1.1k GitHub stars, distributed as the `ghcr.io/germondai/trawl` image; the JavaScript client is not on npm) that, with `MCP_ENABLED=true`, exposes a Streamable HTTP MCP endpoint at `/mcp` with read, scrape, extract, screenshot and inspect tools. The vendor advisory GHSA-mj45-84p2-v77q (2026-11-03, Moderate, CVSS 3.1 5.3, credit Leardian) says the MCP public-destination filter recognised only the dotted-decimal form of IPv4-mapped IPv6 addresses, so the hexadecimal form (`::ffff:7f00:1` for loopback, per the CNA record) was treated as public and a caller, directly or through a redirect from an allowed page, could reach loopback, private-range and cloud metadata destinations and read the responses. The native API's access to private targets is a separate, intentional operator capability and is not the bug. VulnCheck's CVE-2026-122140 (2026-11-04 20:36 UTC, CVSS 4.0 6.3, CVSS 3.1 5.8, CWE-918) states the range as 1.5.0 before 1.10.0, which matches the vendor's 1.5.0 through 1.9.3. The fix in 1.10.0 (GitHub release 03 Nov, year not shown) replaces text-based IPv6 checks with numeric subnet checks and pins public destination IPs at connection time for HTTP and browser traffic, including through upstream proxies; MCP connections get their own clearance cache, and the release requires operators to recreate MCP sessions with `publicOnly: true` and to use an upstream proxy that supports literal-IP CONNECT. The release notes do not use the words SSRF or IPv6. Why it is in this batch: an agent that scrapes through Trawl's MCP endpoint hands the server a URL the model chose, and on a cloud host the metadata service is the credential store that URL can reach. This is the [RAG-ingestion and fetch-tool SSRF shape](2026-11-urlparse-backslash-authority-ssrf-guard-bypass-crewai-cve-2026-120630-langflow-cve-2026-19304-fixed.md) with an address-normalisation bypass instead of a parser discrepancy. Check: `docker image ls | grep trawl` for the tag; anything 1.5.0 through 1.9.3 with MCP enabled is affected; upgrade to 1.10.0 and follow the release's session migration, and rotate the instance's cloud credentials if the MCP endpoint was reachable by untrusted agents or users. ## Update 2026-11-10: six more records, all fixed months before the ids: fast-agent `serve` (CVE-2026-102610), Code Graph RAG (CVE-2026-77604, CVE-2026-87008), tsParticles MCP server (three denial-of-service ids) Six GitHub CNA records published between 2026-11-04 and 2026-11-06 reached the advisory database's `mcp` listing on 2026-11-09. Every one is for a fix that was on the registry by 2026-08-10. The fast-agent and Code Graph RAG vendor advisories are dated July and August; the tsParticles vendor pages were not opened, and their fixes are on npm from 2026-07-01 and 2026-07-10. They are database arrivals, not new disclosures. | Package | CVE | What | Affected (CNA) | Fix on registry | Vendor advisory | CNA score | |---|---|---|---|---|---|---| | `fast-agent-mcp` (PyPI) | CVE-2026-102610 | `fast-agent serve` listened on `0.0.0.0:8000` over HTTP with no authentication and no warning; with `--shell` any caller that reaches the port runs commands as the server user | `< 0.7.21` | 0.7.21, 2026-06-19 | GHSA-9vhv-g5hf-m7m7, 2026-07-22 | CVSS 3.1 6.4 | | `code-graph-rag` (PyPI) | CVE-2026-77604 | the MCP `read_file` tool skipped the project-root check when `offset` or `limit` was set, so an absolute path read any file; the HTTP transport bound `0.0.0.0:8080` with no authentication by default | `< 0.0.345` | 0.0.345, 2026-07-14 | GHSA-vvr2-h2jp-838m, 2026-07-14 | CVSS 3.1 7.5 | | `code-graph-rag` (PyPI) | CVE-2026-87008 | `structural_search` and `structural_replace` checked paths without resolving symlinks, so a symlink in an analysed repository reads or overwrites files outside the root | `< 0.0.589` | 0.0.589, 2026-08-10 | GHSA-85gg-2gfq-q95m, 2026-08-10 | CVSS 3.1 7.1 | | `@tsparticles/mcp-server` (npm) | CVE-2026-63655 | unbounded request-body buffering in HTTP mode | `< 4.3.1` | 4.3.1, 2026-07-01 | GHSA-447x-qqwf-m7xq | CVSS 3.1 7.5 | | `@tsparticles/mcp-server` (npm) | CVE-2026-76892 | a malformed JSON request ends the HTTP process | `< 4.3.1` | 4.3.1, 2026-07-01 | GHSA-4p8p-pjpq-2w7h | CVSS 4.0 8.7 | | `@tsparticles/mcp-server` (npm) | CVE-2026-76893 | one anonymous session can hold HTTP mode and deny new clients | `< 4.3.2` | 4.3.2, 2026-07-10 | GHSA-h7c4-q426-7jh9 | CVSS 4.0 6.9 | **fast-agent.** The vendor scored it Moderate with high privileges and user interaction required (`AV:N/AC:H/PR:H/UI:R`), while its own summary says "Any host that can reach the port can call the exposed `agent` tool" and the reporter left the rating to the maintainers. Both are printed; for an operator who ran `fast-agent serve --shell` on a host with a routable address, the summary is the accurate description. Without `--shell` the exposure is unauthenticated use of the operator's model account and configured MCP tools. PyPI's newest is 0.10.53. Anything from 0.7.21 carries the fix. The fix predates the vendor advisory by five weeks. **Code Graph RAG, a version the registry does not have.** The database row for CVE-2026-87008 prints affected `<= 0.0.586` and patched `0.0.587`. PyPI has no 0.0.587: the versions on either side are 0.0.584 (2026-08-09) and 0.0.589 (2026-08-10), and the CNA record says `< 0.0.589` and references the v0.0.589 release. Use 0.0.589 or later. `pip install code-graph-rag==0.0.587` fails. PyPI's newest is 0.6.30. The symlink bug needs a repository the attacker prepared and a user or agent that runs the structural tools on it; the `read_file` bug needed only network reach to the default HTTP transport. **tsParticles.** Three availability bugs in an MCP server's HTTP mode. They are listed for completeness and carry no data exposure in the records. npm's newest is 4.5.3 (2026-11-06). The CNA lists two products (`tsparticles` and `mcp-server`) for each id; the npm package is `@tsparticles/mcp-server`. **Check.** `pip show fast-agent-mcp code-graph-rag 2>/dev/null | grep -E "^(Name|Version)"` and `npm ls @tsparticles/mcp-server`. For the two Python servers, also check how they are started: any `serve` or `mcp-server` process bound to `0.0.0.0` on a machine with a routable address should move to `127.0.0.1` or behind authentication whatever the version. If a pre-fix `code-graph-rag` or `fast-agent serve --shell` was reachable from an untrusted network, rotate the credentials readable by that user; [if your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md) has the steps. ## Sources - **2026-11-05 update sources** — [germondai/trawl — GHSA-mj45-84p2-v77q](https://github.com/germondai/trawl/security/advisories/GHSA-mj45-84p2-v77q) — fetched 2026-11-05: published 2026-11-03, Moderate, CVSS 3.1 5.3, affected 1.5.0 through 1.9.3, patched 1.10.0, CWE-918, credit Leardian, "CVE: None known" when read; [CVE Services — CVE-2026-122140](https://cveawg.mitre.org/api/cve/CVE-2026-122140) — fetched 2026-11-05: VulnCheck CNA, 2026-11-04 20:36 UTC, 1.5.0 before 1.10.0, CVSS 4.0 6.3 and 3.1 5.8, references; [GitHub Advisory Database — GHSA-42jx-rr99-g8v2](https://github.com/advisories/GHSA-42jx-rr99-g8v2) — fetched 2026-11-05: unreviewed, 2026-11-04, top row of the `mcp` listing; [germondai/trawl — release v1.10.0](https://github.com/germondai/trawl/releases/tag/v1.10.0) — fetched 2026-11-05: 03 Nov, the destination pinning and MCP session migration notes; [germondai/trawl — README](https://github.com/germondai/trawl) — fetched 2026-11-05: the product description, 1.1k stars, the ghcr image tags, the MCP endpoint, the client not published to npm. - [AWS Security Bulletin 2026-164-AWS](https://aws.amazon.com/security/security-bulletins/2026-164-aws/) — fetched 2026-11-03: 2026-11-02 13:30 PST, CVE-2026-116635, "< v0.2.1", "No workarounds are available", credit Syed Anas Mohiuddin. - [awslabs/mcp — GHSA-r6mm-377j-qg8m](https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m) — fetched 2026-11-03: published 2026-11-02, Moderate, CVSS 3.1 6.1, CWE-23 and CWE-36, the `--enable-write` sentence, credit bebold6133. - [CVE Services — CVE-2026-116635](https://cveawg.mitre.org/api/cve/CVE-2026-116635) — fetched 2026-11-03: AWS CNA, published 2026-11-02 21:34 UTC, affected before 0.2.1, CVSS 3.1 6.1 and 4.0 6.9 with vectors. - PyPI `awslabs.aws-serverless-mcp-server`, queried 2026-11-03: 0.2.1 uploaded 2026-10-30 20:56 UTC, 0.2.0 on 2026-08-26; `pip index versions` newest 0.2.1. - [AWS Security Bulletins index](https://aws.amazon.com/security/security-bulletins/) — fetched 2026-11-03: 2026-161 to 2026-164 dated 2026-11-02. - [CVE Services — CVE-2026-121458](https://cveawg.mitre.org/api/cve/CVE-2026-121458) — fetched 2026-11-03: VulnCheck CNA, published 2026-11-03 12:59 UTC, CoreBunch Instatic 0.0.12 before 0.0.21, CVSS 4.0 7.1 and 3.1 6.5, references to the vendor advisory, the v0.0.21 release and the VulnCheck index. - [CoreBunch/Instatic — GHSA-x5cc-8486-8qqx](https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx) — fetched 2026-11-03: published 2026-11-03, Moderate, CVSS 3.1 6.5, affected below 0.0.21, patched 0.0.21, container image `ghcr.io/corebunch/instatic`. - [CoreBunch/Instatic — release v0.0.21](https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21) — fetched 2026-11-03: released 12 Oct (year not shown), the row-access and MCP relay items, no security wording, no advisory id. - [VulnCheck — advisories index](https://www.vulncheck.com/advisories) — fetched 2026-11-03: page 1, twenty records dated 2026-11-03, the Instatic row first. - [AWS Security Bulletin 2026-163-AWS](https://aws.amazon.com/security/security-bulletins/2026-163-aws/) — fetched 2026-11-03: 2026-11-02 11:00 PST, CVE-2026-120497, ">=0.1.0 AND