CVE-2026-15415: AWS HealthOmics Path Traversal Flaw

CVE-2026-15415 Overview

CVE-2026-15415 is a path traversal vulnerability in the AWS HealthOmics Model Context Protocol (MCP) Server (aws-healthomics-mcp-server) before version 0.0.36. The linting tools improperly limit pathnames to a restricted directory. An actor who can influence the MCP agent can write attacker-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory. Exploitation occurs through directory traversal sequences supplied in the workflow_files input. AWS HealthOmics is a HIPAA-eligible service that manages compute, storage, and workflow engine infrastructure for bioinformatics analyses in clinical diagnostics, drug discovery, and agricultural research. The flaw is tracked as [CWE-23: Relative Path Traversal].

Critical Impact
An actor influencing the MCP agent can write arbitrary content to locations outside the workflow bundle directory, enabling file overwrite and potential local integrity compromise.

Affected Products

AWS HealthOmics MCP Server (awslabs.aws-healthomics-mcp-server) versions prior to 0.0.36
AWS Labs MCP repository components exposing linting tools that accept workflow_files input
Environments running the MCP server locally to orchestrate HealthOmics workflow bundles

Discovery Timeline

2026-07-17 - CVE-2026-15415 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-15415

Vulnerability Analysis

The AWS HealthOmics MCP Server exposes linting tools that accept a workflow_files input structure. This structure declares file paths and content the server writes to disk before validating a bioinformatics workflow bundle. The server does not properly canonicalize or restrict these paths to the intended bundle directory. An actor able to influence the MCP agent, for example through crafted prompts or upstream tool inputs, can supply directory traversal sequences such as ../ in file path fields. The server then writes actor-controlled content to arbitrary locations reachable by the process user. The impact is scoped to integrity: an attacker can overwrite files including shell profiles, configuration files, or credentials that later grant additional access. Confidentiality and availability are not directly impacted according to the published CVSS 4.0 vector.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-23] within the linting tool handlers. Path values from the workflow_files input are joined with a base directory without validating that the resulting canonical path remains inside that base. Traversal segments are not stripped or rejected.

Attack Vector

The attack requires local access and user interaction with the MCP agent. An actor influences the agent through prompt injection, malicious tool responses, or supplied workflow inputs. When the agent invokes the vulnerable linting tool, the server writes attacker-controlled content to attacker-chosen paths. See the GitHub Security Advisory GHSA-6x7f-488g-75wm for advisory details.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the AWS Security Bulletin 2026-060 for authoritative technical detail.

Detection Methods for CVE-2026-15415

Indicators of Compromise

Files written outside the expected workflow bundle directory by the aws-healthomics-mcp-server process
Presence of ../ or absolute path segments inside workflow_files inputs captured in MCP agent logs
Unexpected modifications to user dotfiles, shell profiles, or configuration files on hosts running the MCP server

Detection Strategies

Audit MCP agent conversation logs and tool invocation records for workflow_files entries containing traversal characters or absolute paths
Enable filesystem auditing (auditd on Linux, FSEvents on macOS) for write operations by the MCP server process outside its designated working directory
Compare installed package versions against 0.0.36 on all hosts using pip show awslabs.aws-healthomics-mcp-server

Monitoring Recommendations

Alert on file writes originating from the MCP server process targeting paths outside the configured workflow bundle root
Track version drift for the awslabs.aws-healthomics-mcp-server PyPI package across development and analyst workstations
Monitor process lineage where the MCP server spawns child processes reading recently written files in sensitive directories

How to Mitigate CVE-2026-15415

Immediate Actions Required

Upgrade awslabs.aws-healthomics-mcp-server to version 0.0.36 or later on every host that runs the MCP server
Inventory MCP agent deployments that integrate the AWS HealthOmics tools and confirm the installed package version
Restrict the MCP server process to a dedicated, unprivileged user account with write access only to the intended workflow bundle directory

Patch Information

AWS resolved the issue in version 0.0.36 of the awslabs.aws-healthomics-mcp-server package. Install the fixed release from PyPI Package Release 0.0.36. Additional remediation guidance is published in the AWS Security Bulletin 2026-060.

Workarounds

Run the MCP server inside a container or sandbox with a read-only root filesystem and a single writable volume mounted at the workflow bundle path
Filter or reject MCP tool inputs whose workflow_files entries contain .., absolute paths, or symbolic link targets before they reach the server
Limit which actors and upstream tools can supply inputs to the MCP agent to reduce prompt injection exposure

bash

# Upgrade the vulnerable package to the fixed release
pip install --upgrade 'awslabs.aws-healthomics-mcp-server>=0.0.36'

# Verify the installed version
pip show awslabs.aws-healthomics-mcp-server | grep -i version