AWS HealthLake MCP Server SSRF Flaw Allows Credential Theft Before 0.0.14

AWS published security bulletin 2026-054-AWS on July 14, 2026, disclosing CVE-2026-15643, a server-side request forgery vulnerability in the AWS HealthLake MCP Server. The flaw exists in the pagination handling component of the awslabs.healthlake-mcp-server software, which enables AI assistants to interact with AWS HealthLake FHIR datastores.

The vulnerability allows a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint. According to the advisory, this occurs because the server fails to validate that pagination URLs point back to the expected HealthLake endpoint. An attacker can craft a specific next_token parameter to redirect subsequent requests to a server they control.

Context and Technical Details

The issue is rated as important and requires attention. It affects all platforms running the awslabs.healthlake-mcp-server software in versions before 0.0.14. The server-side request forgery arises from unvalidated input in the pagination logic.

AWS confirmed that the problem has been addressed in awslabs.healthlake-mcp-server version 0.0.14. The vendor recommends upgrading to this latest version immediately. Users who have forked or created derivative code from the original repository must also patch their code to incorporate the new fixes provided by AWS.

Who Is Affected

Any deployment using the affected versions of the HealthLake MCP Server is at risk. The advisory specifically warns operators not to rely on the --readonly flag as a security boundary. This flag acts only as an in-process guard over mutating tools, not as an IAM control.

Consequently, disclosed credentials retain their full granted authority even if the readonly flag is set. Operators using role-based deployments via Security Token Service should consider rotating the affected role's credentials if they suspect they are using an affected version. AWS thanked Marios Gyftos for collaborating through the coordinated vulnerability disclosure process.

What should you do?

Administrators should verify their current version of the awslabs.healthlake-mcp-server and upgrade to 0.0.14 if running an older release. Those unable to upgrade immediately must scope the IAM policy used by the server to least privilege rather than using Resource: "*".

Background: Coordinated vulnerability disclosure

Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.

Read the full guide: Coordinated Vulnerability Disclosure for Small Teams

What to do and how to stay safe: AWS

• Verify if your environment runs awslabs.healthlake-mcp-server versions prior to 0.0.14 and upgrade to the patched version.
• Restrict the IAM policy associated with the server to least privilege, avoiding wildcard resource permissions.
• Rotate credentials for any STS roles if you suspect prior exposure to the vulnerability.
• Monitor logs for unusual outbound requests or redirect patterns from the MCP Server.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-15643?

It is a server-side request forgery vulnerability in the AWS HealthLake MCP Server that allows authenticated users to exfiltrate credentials via unvalidated pagination URLs.

Which versions are affected?

The vulnerability affects awslabs.healthlake-mcp-server versions before 0.0.14 on all platforms.

Is there a fix available?

Yes, AWS released version 0.0.14 which addresses the issue. Users should upgrade to this version or apply the fix to forked code.