Security Advisory

CVE-2026-15643

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-14 20:03:58

Last updated 2026-07-15 14:22:10

Assigner AMZN

CVSS score 9.2

State PUBLISHED

Description

AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Its recommended to upgrade to version 0.0.14 or later.

← Browse all CVEs View on cve.org ↗