CVE-2026-18953

Executive Summary

CVE-2026-18953 is a critical path traversal vulnerability (CWE-22) affecting Amazon's aws-transform-mcp-server versions 0.1.0 through 0.1.4. The flaw resides in the get_resource tool's savePath parameter, allowing a context-dependent actor to write arbitrary files outside the intended working directory. With a CVSS score of 8.6 and no authentication required (PR:N), successful exploitation can lead to full confidentiality, integrity, and availability compromise. The vendor has released version 0.1.5 to remediate this issue, though patch confirmation is limited to a single source (NVD).

Technical Analysis

The vulnerability is rooted in improper validation of the savePath parameter within the get_resource tool of the aws-transform-mcp-server package. This MCP (Model Context Protocol) server is designed to facilitate resource transformation workflows, typically invoked by AI assistants or automated tooling to fetch and store cloud resources.

The core issue is a classic path traversal flaw (CWE-22). The application accepts a user-supplied savePath value without adequately restricting it to the intended working directory. An attacker can supply path traversal sequences such as ../../ to escape the sandboxed directory and write to arbitrary locations on the filesystem.

From a code perspective, the vulnerable logic likely resembles:

def get_resource(resource_id, save_path):
    # Vulnerable: no path sanitization
    with open(save_path, 'w') as f:
        f.write(fetch_resource(resource_id))

The absence of a canonicalization check (e.g., using os.path.realpath() or ensuring the resolved path stays within a base directory) allows the traversal.

The attack surface is significant because:

1. No authentication required — the CVSS vector shows PR:N, meaning the vulnerability can be triggered without prior credentials, though it requires user interaction (UI:R) and local access (AV:L).
2. MCP server context — MCP servers are often connected to AI assistants or automation pipelines, making them prime targets for prompt-injection or indirect attack vectors.
3. Arbitrary file write — the C:H/I:H/A:H components indicate that an attacker can trigger complete impact on confidentiality, integrity, and availability.

The C:S (scope change) in the CVSS vector indicates that the compromised component's scope extends beyond its security authority, potentially granting an attacker access to resources outside the MCP server's sandbox.

Exploitation Scenarios

This vulnerability is exploitable by any actor who can interact with the MCP server — either directly or via an upstream AI tool that consumes MCP services. Here is a concrete attack chain:

1) Reconnaissance / Target Identification An attacker first identifies exposed MCP server endpoints. Since MCP servers often run as local processes or on internal addresses (e.g., localhost:8080), the attacker may need local access or a way to indirectly invoke the tool through a compromised AI assistant. Shodan queries for open MCP endpoints or exposed port 3000-9000 ranges can help identify internet-facing instances.

2) Weaponization — Crafting the Traversal Payload The attacker constructs a malicious get_resource invocation with a crafted savePath:

POST /mcp HTTP/1.1
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "get_resource",
    "arguments": {
      "resource_id": "arn:aws:s3:::bucket/object",
      "savePath": "../../../../../../tmp/evil.sh"
    }
  }
}

The repeated ../ sequences bypass any naive filtering and resolve to an absolute path like /tmp/evil.sh when combined with the working directory.

3) Payload / Execution The server writes the fetched resource content to /tmp/evil.sh. The attacker tricks the server into fetching a malicious script from an S3 bucket or other resource source, then uses further MCP tool calls (or a secondary write) to place the file in a location such as /etc/cron.d/ or a web-accessible directory:

"savePath": "../../../../../../etc/cron.d/backdoor"

Alternatively, the attacker can:

• Overwrite configuration files (e.g., /etc/ssh/sshd_config) to enable remote access.
• Write a web shell into a served web directory.
• Replace system binaries (if running with elevated privileges).

4) Post-Exploitation With arbitrary file write capability, the attacker achieves:

• Persistence — via cron jobs, systemd units, or SSH keys.
• Privilege escalation — by writing to /etc/sudoers or time-based job directories.
• Data exfiltration — by reading sensitive files via the inverse operation (writing content to attacker-controlled paths).

The scope change (C:S) means the attacker's influence breaks trust boundaries, affecting the broader host system, not just the MCP server process.

Impact Assessment

Business Impact: Critical (CVSS 8.6, High severity). The vulnerability allows unauthenticated (PR:N) arbitrary file write on the host system where the MCP server executes. This can lead to:

• Confidentiality breach (C:H) — reading sensitive local files or cloud credentials stored on disk.
• Integrity compromise (I:H) — overwriting system or application files to plant malicious code.
• Availability loss (A:H) — corrupting critical files or services, causing denial of service.

Affected Systems: All deployments of aws-transform-mcp-server 0.1.0–0.1.4, typically running in:

• CI/CD pipelines that use MCP for cloud resource transformation.
• AI assistant backends (LangChain, AutoGPT integrations) invoking MCP tools.
• DevOps automation servers.

Blast Radius: Because the MCP server often runs with service account privileges, exploitation could grant the attacker access to the entire AWS environment the account can reach, in addition to local host compromise. The scope change elevates the risk from a sandboxed tool failure to full system takeover.

CVSS Breakdown Reference: The 8.6 score reflects a High severity with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — local attack vector, low complexity, no privileges, user interaction required, scope change, and high impact across all three security dimensions.

Detection Guidance

Sigma Rule

title: Potential Path Traversal via aws-transform-mcp-server get_resource
id: 5e3c7f2a-8b6d-4a11-9c3e-6d2f8a1b4e9c
status: experimental
description: Detects malicious savePath arguments containing path traversal sequences in aws-transform-mcp-server MCP tool calls
author: vartersit.com Threat Intel
date: 2026/02/18
logsource:
  category: application
  product: mcp_server
detection:
  selection:
    event.action: tools/call
    event.method: get_resource
    params.arguments.savePath|contains:
      - '..%2f'
      - '../'
      - '..\\'
      - '%2e%2e'
      - '....//'
  condition: selection
fields:
  - params.arguments.savePath
  - params.arguments.resource_id
falsepositives:
  - Legitimate path normalization by DevOps tooling
level: high

YARA Rule

rule aws_transform_mcp_path_traversal
{
    meta:
        author = "vartersit.com Threat Intel"
        date = "2026-02-18"
        description = "Detects path traversal payloads targeting CVE-2026-18953"
        cve = "CVE-2026-18953"
        severity = "critical"
    strings:
        $json_key = "savePath" ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "..%2f" ascii nocase
        $traversal4 = "%2e%2e%2f" ascii nocase
        $traversal5 = "....//" ascii
        $mcp_call = "get_resource" ascii nocase
    condition:
        $json_key and $mcp_call and any of ($traversal*)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-18953 - Path Traversal in aws-transform-mcp-server get_resource";
    content:"get_resource"; http_client_body;
    content:"savePath"; http_client_body;
    pcre:"/savePath[\"']?\s*[:=]\s*[\"'][^\"']*(\.\.\/|\.\.\\|%2e%2e)/i";
    sid:10018953;
    rev:1;
    classtype:attempted-admin;
    metadata:created_at 2026_02_18, cve CVE_2026_18953, severity critical;
)

Elastic Detection

sequence by process.entity_id
  [process where event.action == "exec" and process.name : "mcp-server*"]
  [file where event.action == "write" and file.path : "*/../*"
   and process.name : "mcp-server*"]

This EQL rule detects a write operation by the MCP server process to a file path containing traversal sequences, indicating a successful exploitation attempt.

Splunk SPL Query

index=* sourcetype=mcp_server
| where regex _raw "savePath.*(?:\.\./|\.\.\\|%2e%2e)"
| eval threat_score = case(match(_raw, "\.\./"), 8, match(_raw, "%2e%2e"), 9, 6)
| stats count by host, process_name, savePath
| where threat_score >= 8
| table _time, host, process_name, savePath, count

This query surfaces all MCP server log entries referencing savePath with traversal indicators, scoring them by threat potential.

Wazuh OSSEC Rule

<rule id="118953" level="12">
  <if_sid>57150</if_sid>
  <regex>savePath.*(\.\./|\.\.\\|%2e%2e)</regex>
  <description>CVE-2026-18953: Path traversal detected in aws-transform-mcp-server get_resource savePath parameter</description>
  <group>pci_dss_6.5.1, gdpr_IV_35.7.d, cve_2026_18953,</group>
  <mitre>
    <id>T1083</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

1) Immediate Mitigations (before patching):

• Restrict execution context: Run the MCP server under a dedicated low-privilege user account with minimal filesystem permissions.
• Filesystem sandboxing: Use OS-level controls (e.g., chroot, Docker, seccomp) to confine the server to a specific working directory.
• Network access control: Ensure the MCP endpoint is not exposed externally; restrict access to authorized automation systems only.
• Input validation at a proxy: If the MCP server is behind a gateway, add WAF rules to block savePath values containing ../ or encoded variants.

2) Patch / Upgrade Steps: Upgrade to version 0.1.5 or later, which includes a fix for this path traversal issue. Deploy via your package manager:

• npm (Node.js ecosystem): npm update aws-transform-mcp-server@^0.1.5
• yarn: yarn upgrade aws-transform-mcp-server --latest

Verify the upgrade: npm list aws-transform-mcp-server should show 0.1.5 or higher.

Note: The patch confidence is rated 2/4 because only NVD currently confirms the fix. After upgrading, validate that the savePath parameter is properly canonicalized by testing traversal payloads.

3) Long-Term Hardening:

• Adopt secure coding practices: For any path-handling logic, use path.resolve() and verify the result stays within the intended base directory before writing files.
• Implement application-level allowlists: Restrict savePath to a predefined set of acceptable paths or patterns.
• Continuous monitoring: Deploy the detection rules above to alert on any future traversal attempts.
• Regulary update MCP dependencies: Monitor vendor advisories for the aws-transform-mcp-server project and apply security patches in a timely manner.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18953
2. Vendor Advisory (NVD source): https://nvd.nist.gov/vuln/detail/CVE-2026-18953#vulnCurrentDescriptionTitle
3. CWE-22 Reference: https://cwe.mitre.org/data/definitions/22.html
4. MITRE ATT&CK — Path Traversal (T1083): https://attack.mitre.org/techniques/T1083/
5. EPSS Score Information: https://www.first.org/epss/data_stats

Threat Actor Activity: As of this report, CVE-2026-18953 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and there are no documented threat actor campaigns leveraging this vulnerability in the wild. The EPSS score of 0.00149 (4.6th percentile) suggests low immediate exploitation probability, but the public PoC availability and high potential impact warrant prompt remediation.