Key points
- Versions before 0.0.14 of awslabs.healthlake-mcp-server are affected by CVE-2026-15643.
- The vulnerability allows authenticated users to exfiltrate credentials to arbitrary endpoints.
- AWS has released version 0.0.14 to address the server-side request forgery issue.
AWS has released version 0.0.14 of the HealthLake MCP Server to fix a server-side request forgery vulnerability. This update addresses CVE-2026-15643, which affects all versions prior to 0.0.14 on every supported platform.
What happened
AWS Security Bulletins reported that the HealthLake MCP Server contains a flaw in its pagination handling component. The server fails to validate that pagination URLs point to the expected HealthLake endpoint. This lack of validation allows remote authenticated users to redirect subsequent requests to servers they control.
Why it matters
An attacker can exploit this flaw using a crafted next_token parameter. This action enables the exfiltration of AWS temporary security credentials to an arbitrary endpoint. The disclosed credentials retain the full authority granted by the server's IAM policy.
What happens next
AWS recommends upgrading to version 0.0.14 immediately. Users with forked or derivative code must ensure they incorporate the new fixes. Operators should scope the server's IAM policy to least privilege rather than using Resource: "*".
Patch priority
Security operations teams should prioritise updating systems exposed to authenticated users or external networks. Verify the current version of the HealthLake MCP Server across all environments before applying the patch. Test the update in a non-production environment to ensure compatibility with existing workflows. Back up configuration files prior to the upgrade to facilitate rollback if issues arise. Restrict network access to the server during the patching window to minimise exposure. Monitor logs for unusual outbound traffic patterns that might indicate credential exfiltration attempts.
What to do and how to stay safe: AWS
- Audit IAM policies for the HealthLake MCP Server to enforce least privilege access controls.
- Verify whether the --readonly flag is being used as a sole security boundary and remove that reliance.
- Rotate credentials for STS-based deployments if you suspect the affected version was used.
- Monitor network traffic for unexpected connections to external endpoints from the MCP Server.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-15643?
It is a server-side request forgery vulnerability in the HealthLake MCP Server's pagination handler that allows credential theft.
Which versions are affected?
All versions of awslabs.healthlake-mcp-server before 0.0.14 are affected on all platforms.
Is there a fix available?
Yes, AWS has released version 0.0.14 which addresses this vulnerability.
