AWS repairs a file write bug in its Transform MCP server

On 5 August 2026, Amazon gave a security bulletin for CVE-2026-18953, a bug in the AWS Transform MCP server (Model Context Protocol). This software connects an AI assistant to tools on the computer of a developer. Versions 0.1.0 to 0.1.4 have the bug, Amazon gives it a score of 8.6, High, and version 0.1.5 repairs it.

How it works

The tool that gets task files did not check pathnames. Because of this, the savePath parameter could write files in other directories than the working directory. The advisory of Amazon tells that this could cause local code execution.

The numbers

• Amazon gave the bug a score of 8.6, High. NIST gave 8.8.
• With the new method, Amazon gave 6.3, Medium.
• The sources give no report of an attack. The agency CISA of the US gives the use of the bug in attacks as none.

What is not known

Amazon does not tell who the context-dependent actor is. A code repository from an external author tells that an assistant that gets untrusted content through the same tool can supply the path. Amazon does not tell this.

Insight: MCP servers are a repeat weak point at AWS

In 2026, AWS also told users about bugs in 3 other tools: its MySQL server, its Security Agent and its API server. Possibly checks around MCP servers are thin: each tool connects an AI assistant to code or data, and each bug is a missing check. A local MCP server operates with the permissions of your developer.