CVE-2026-15643: AWS HealthLake MCP Server SSRF Vulnerability

CVE-2026-15643 Overview

CVE-2026-15643 is a Server-Side Request Forgery (SSRF) vulnerability in the AWS HealthLake Model Context Protocol (MCP) Server package awslabs.healthlake-mcp-server before version 0.0.14. The MCP server enables AI assistants to interact with AWS HealthLake Fast Healthcare Interoperability Resources (FHIR) datastores. The pagination handling component fails to validate that URLs supplied via the next_token parameter point back to the expected HealthLake endpoint. A remote authenticated user can craft a next_token value that redirects subsequent server-issued requests to an attacker-controlled host, exfiltrating AWS temporary security credentials in the process.

Critical Impact
An authenticated attacker can exfiltrate AWS temporary security credentials from the MCP server to an arbitrary endpoint, enabling potential access to HealthLake FHIR datastores and connected AWS resources.

Affected Products

awslabs.healthlake-mcp-server versions prior to 0.0.14
AWS HealthLake MCP Server deployments on all platforms
AI assistant integrations relying on the vulnerable MCP server package

Discovery Timeline

2026-07-14 - CVE-2026-15643 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15643

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery [CWE-918]. The awslabs.healthlake-mcp-server package acts as a bridge between AI assistants and AWS HealthLake FHIR datastores. When paginated FHIR queries are issued, the HealthLake service returns a next_token value that the MCP server uses to fetch subsequent result pages.

The server treats the pagination URL contained in or derived from next_token as trusted. It reuses AWS SigV4 signing and attaches temporary security credentials to the outbound request. Because the destination host is not restricted to expected HealthLake endpoints, the credentials can be sent to any URL an authenticated user supplies.

Exploitation requires an authenticated session and user interaction, but the impact spans confidentiality of credentials, integrity of downstream AWS calls, and confidentiality of resources reachable with those credentials.

Root Cause

The root cause is missing allow-list validation on the pagination URL. The pagination handler in versions prior to 0.0.14 does not compare the scheme, host, and region of the next_token URL against the configured HealthLake endpoint before dispatching the signed HTTP request.

Attack Vector

An authenticated user issues a request to the MCP server that includes a crafted next_token parameter pointing to an attacker-controlled server. The MCP server signs the outbound request with active AWS temporary credentials and delivers them to the attacker endpoint in the Authorization header and associated SigV4 metadata. The attacker then possesses short-lived credentials scoped to the MCP server's IAM role.

No verified public exploit code is available. See the AWS Security Bulletin 2026-054 for vendor-published technical details.

Detection Methods for CVE-2026-15643

Indicators of Compromise

Outbound HTTPS requests from hosts running awslabs.healthlake-mcp-server to domains outside the *.healthlake.*.amazonaws.com namespace.
next_token parameter values in MCP server logs that contain absolute URLs pointing to non-AWS hosts or unexpected AWS regions.
CloudTrail entries showing use of the MCP server's IAM role credentials from unfamiliar source IP addresses or user agents.

Detection Strategies

Instrument the MCP server process with egress filtering and alert on any destination host that does not match the configured HealthLake endpoint.
Parse MCP request logs for next_token values and flag entries where the decoded value is a fully qualified URL.
Correlate STS AssumeRole events with subsequent API calls from IP addresses that do not belong to your workload subnets.

Monitoring Recommendations

Enable AWS CloudTrail data events for HealthLake and monitor for anomalous credential reuse patterns.
Forward MCP server application logs to a centralized data lake and retain sufficient history to investigate credential exposure windows.
Alert on any process on the MCP host initiating TLS connections to newly observed external domains.

How to Mitigate CVE-2026-15643

Immediate Actions Required

Upgrade awslabs.healthlake-mcp-server to version 0.0.14 or later on every host that runs the package.
Rotate any AWS temporary security credentials and long-lived keys accessible to the MCP server's IAM role.
Audit CloudTrail for use of the MCP server role during the exposure window and revoke sessions that appear anomalous.

Patch Information

AWS released a fixed version of the package that validates pagination URLs against the expected HealthLake endpoint. Install the update from PyPI Package Release Note 0.0.14. Full remediation guidance is published in AWS Security Bulletin 2026-054.

Workarounds

Restrict egress from MCP server hosts to only the HealthLake service endpoints required by the workload.
Scope the IAM role attached to the MCP server to the minimum HealthLake actions and datastore ARNs needed for operation.
Limit MCP server access to trusted authenticated users until the upgrade to 0.0.14 is complete.

bash

# Upgrade the vulnerable package to the fixed release
pip install --upgrade 'awslabs.healthlake-mcp-server>=0.0.14'

# Verify the installed version
pip show awslabs.healthlake-mcp-server | grep -i version