{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-15643",
    "name": "CVE-2026-15643",
    "vendor": "awslabs.healthlake-mcp-server",
    "description": "The AWS HealthLake MCP server before 0.0.14 did not validate that a pagination URL pointed back at the expected HealthLake endpoint, so a crafted next_token could redirect the server's follow-up request to an actor-controlled host - and because that request is signed, the redirect carries AWS temporary security credentials to whatever endpoint the attacker named. AWS published it as security bulletin 2026-054-AWS on 15 July 2026 and fixed it in 0.0.14. It is rated medium and needs an authenticated remote user, which is the right rating for the mechanism and understates the consequence, because what leaves is a credential rather than a document: the exposure is AWS session material for whatever role the server runs as, and the data at the other end of a HealthLake datastore is FHIR health records. The pattern generalises past this server. A pagination cursor looks like an opaque bookkeeping value, so it tends to be handled as data rather than as a URL the server will fetch, which is how a continuation token becomes a full SSRF primitive with the server's own identity attached.",
    "website": "https://aws.amazon.com/security/security-bulletins/2026-054-aws/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "awslabs.healthlake-mcp-server",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-15",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-15643",
      "aliases": [
        "ti-096"
      ],
      "title": "CVE-2026-15643: The AWS HealthLake MCP Server Followed an Attacker's Pagination URL, Carrying AWS Credentials",
      "summary": "The AWS HealthLake MCP server before 0.0.14 did not validate that a pagination URL pointed back at the expected HealthLake endpoint, so a crafted next_token could redirect the server's follow-up request to an actor-controlled host - and because that request is signed, the redirect carries AWS temporary security credentials to whatever endpoint the attacker named. AWS published it as security bulletin 2026-054-AWS on 15 July 2026 and fixed it in 0.0.14. It is rated medium and needs an authenticated remote user, which is the right rating for the mechanism and understates the consequence, because what leaves is a credential rather than a document: the exposure is AWS session material for whatever role the server runs as, and the data at the other end of a HealthLake datastore is FHIR health records. The pattern generalises past this server. A pagination cursor looks like an opaque bookkeeping value, so it tends to be handled as data rather than as a URL the server will fetch, which is how a continuation token becomes a full SSRF primitive with the server's own identity attached.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Server-side request forgery"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "awslabs.healthlake-mcp-server",
        "vendor": null,
        "package": "awslabs.healthlake-mcp-server",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<0.0.14",
          "fixed": "0.0.14"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-15",
      "modifiedAt": "2026-07-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://aws.amazon.com/security/security-bulletins/2026-054-aws/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15643"
        }
      ],
      "mitigation": "Upgrade to 0.0.14 or later. Then treat the role the server assumed as exposed for the period it ran a vulnerable version reachable by anyone you do not fully trust: rotate it, and read CloudTrail for that role rather than assuming nothing happened, since a credential exfiltrated this way is used from outside your network and shows up as calls from an unfamiliar source. Scope the role down while you are in there - an MCP server serving read queries against a FHIR datastore rarely needs a role that would be worth stealing. More broadly, this is a checkable property in any MCP server you run: if a tool accepts a token, cursor, callback or next-page value that the server will later fetch, the server must confirm the resulting host is one it expects, and a server that will fetch an arbitrary host while holding cloud credentials is one finding away from a cloud incident.",
      "detectedByAnomity": true
    }
  }
}