CVE-2026-18953: AWS Transform MCP Server Path Traversal

CVE-2026-18953 Overview

CVE-2026-18953 is a path traversal vulnerability in the get_resource tool of the Amazon awslabs.aws-transform-mcp-server package, versions 0.1.0 through 0.1.4. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. A context-dependent actor can supply a crafted savePath parameter to write arbitrary files outside the intended working directory. Successful exploitation impacts the confidentiality, integrity, and availability of resources in the subsequent system scope, since files written outside the server's working directory can overwrite configuration, code, or other sensitive artifacts. Amazon addressed the issue in version 0.1.5.

Critical Impact
An attacker who influences the savePath argument to the get_resource MCP tool can write arbitrary files outside the intended directory, enabling code overwrites, configuration tampering, and downstream compromise of the host running the server.

Affected Products

awslabs.aws-transform-mcp-server version 0.1.0
awslabs.aws-transform-mcp-server versions 0.1.1 through 0.1.4
Model Context Protocol (MCP) integrations depending on the vulnerable package

Discovery Timeline

2026-08-05 - CVE-2026-18953 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in the NVD database

Technical Details for CVE-2026-18953

Vulnerability Analysis

The awslabs.aws-transform-mcp-server package exposes a Model Context Protocol (MCP) server that AI assistants and automation tooling can call to perform AWS transformation operations. The get_resource tool accepts a savePath parameter that specifies where retrieved resource content should be written on disk.

In versions 0.1.0 through 0.1.4, the server does not properly constrain savePath to the intended working directory. Supplying traversal sequences such as ../ or an absolute path causes the write to resolve outside the sandbox. This lets a caller who controls the tool arguments place attacker-chosen content at arbitrary locations the server process can access.

Because MCP servers are typically invoked by AI agents interpreting untrusted context, indirect prompt injection can turn the flaw into a remote-influenced local write. The impact extends beyond the server itself, affecting the host filesystem and any subsequent process that reads the written file.

Root Cause

The root cause is missing canonicalization and containment checks on the savePath argument before file write operations. The tool concatenates or resolves the caller-supplied path without validating that the final resolved path remains within an allowlisted base directory, matching the classic pattern described in CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires local invocation of the MCP server and some form of user or agent interaction to trigger the vulnerable tool call. An attacker who can influence the arguments passed to get_resource, either directly through a malicious MCP client or indirectly through prompt injection into an AI assistant that calls the server, can set savePath to a location outside the working directory. The server then writes retrieved content to that path with the privileges of the server process.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-66mr-jr63-2jgw and the AWS Security Bulletin 2026-075 for vendor details.

Detection Methods for CVE-2026-18953

Indicators of Compromise

Files created or modified outside the configured working directory of the aws-transform-mcp-server process, particularly under user home directories, ~/.aws/, ~/.ssh/, or system configuration paths.
MCP request logs containing savePath values with ../ sequences, absolute paths, or references to sensitive filesystem locations.
Unexpected writes to shell startup files (.bashrc, .zshrc, .profile) or scheduled task definitions on hosts running the MCP server.

Detection Strategies

Inspect installed Python packages for awslabs.aws-transform-mcp-server versions 0.1.0 through 0.1.4 using pip show or SBOM tooling.
Enable verbose logging on the MCP server and alert on get_resource invocations where savePath contains traversal characters or resolves outside the allowlisted base directory.
Correlate process telemetry from the MCP server process with file-write events to paths outside its expected working directory.

Monitoring Recommendations

Continuously monitor file integrity for AWS credential files, SSH keys, and shell profile scripts on developer workstations and CI runners running MCP servers.
Track outbound tool calls from AI assistants and log the full arguments passed to MCP tools for retrospective analysis.
Alert on new or updated MCP server installations to ensure vulnerable versions are not reintroduced through automation pipelines.

How to Mitigate CVE-2026-18953

Immediate Actions Required

Upgrade awslabs.aws-transform-mcp-server to version 0.1.5 or later on every host, container, and developer workstation.
Audit MCP client configurations to confirm they reference the patched version and remove pinned installations of 0.1.0 through 0.1.4.
Review recent get_resource invocations for suspicious savePath values and investigate any file writes outside expected working directories.

Patch Information

Amazon released the fix in awslabs.aws-transform-mcp-server 0.1.5 on PyPI. Additional vendor guidance is available in the AWS Security Bulletin 2026-075 and the GitHub Security Advisory GHSA-66mr-jr63-2jgw.

Workarounds

Run the MCP server as a dedicated low-privilege user with filesystem access restricted to a minimal working directory using OS-level sandboxing (for example, chroot, bwrap, or container isolation).
Disable the get_resource tool in MCP client configurations until the upgrade to 0.1.5 is complete.
Reject or sanitize MCP tool arguments at a proxy layer, dropping any savePath value containing .., absolute paths, or symbolic link targets.

bash

# Configuration example: upgrade the vulnerable package
pip install --upgrade 'awslabs.aws-transform-mcp-server>=0.1.5'

# Verify the installed version
pip show awslabs.aws-transform-mcp-server | grep -i version