Ansible Lightspeed MCP server path traversal lets prompt injection write files outside intended directory

Red Hat (Ansible Lightspeed VS Code extension users)·Ansible Lightspeed Model Context Protocol (MCP) server, VS Code extensionUnresolved

The Ansible Lightspeed MCP server could be steered by an attacker via indirect prompt injection into writing files to unauthorized, user-writable locations on the host, a classic path-traversal flaw (CWE-22) triggered through the AI agent's own file-write actions when a user initiates an Ansible Execution Environment build.

Blast radius

Red Hat's advisory states the flaw can expose sensitive host information and enable staged remote code execution, potentially leading to full system compromise; CISA's SSVC assessment lists exploitation status as 'none' and no specific victims, data volumes, or in-the-wild attacks are disclosed.

Root cause

The MCP server did not sufficiently validate or canonicalize file paths that the AI agent could be manipulated into writing to, so attacker-controlled content reaching the agent via prompt injection could direct writes outside the intended directory.

How it was caught

Found and reported internally by a Red Hat researcher (Laura Pardo) and tracked through Red Hat's CVE/Bugzilla process before any public exploitation was reported.

What changed

Red Hat states that as of the advisory, no mitigation meeting its deployment and stability criteria is available; it notes the vulnerable code ships only via the VS Code Marketplace extension and is not present in Ansible Automation Platform RPMs or containers.

Take-awayAny MCP server that lets an LLM agent choose file-write destinations must canonicalize and allow-list paths server-side, because indirect prompt injection can steer the agent's own tool calls into writing anywhere the underlying process has permission to reach.