Key points
- CVE-2026-15643 affects AWS HealthLake MCP Server versions prior to 0.0.14.
- Attackers can exfiltrate AWS temporary security credentials via crafted next_token parameters.
- AWS released version 0.0.14 to fix the server-side request forgery vulnerability.
The AWS HealthLake MCP Server contains a server-side request forgery flaw that enables credential theft. According to the AWS Security Bulletins, the vulnerability, tracked as CVE-2026-15643, exists in the pagination handling component. Remote authenticated users can exploit this issue to send AWS temporary security credentials to endpoints they control. This occurs because the server fails to validate that pagination URLs point to the expected HealthLake endpoint.
By the numbers
- CVE-2026-15643 is the identifier for the server-side request forgery vulnerability.
- Version 0.0.14 is the first release that addresses the unvalidated pagination URL issue.
- Bulletin ID 2026-054-AWS is the official advisory published by AWS on July 14, 2026.
What the figures mean
The publication of bulletin 2026-054-AWS on July 14, 2026, signals that AWS has confirmed the severity of the flaw. The introduction of version 0.0.14 provides a concrete remediation path for users running the awslabs.healthlake-mcp-server. The CVE identifier allows security teams to track this specific server-side request forgery across vulnerability databases. This version boundary defines which installations remain exposed to credential exfiltration risks.
What to watch
Teams should verify that their deployments of the HealthLake MCP Server are running version 0.0.14 or later. Operators using role-based deployments with Security Token Service should consider rotating credentials if they suspect exposure. The advisory warns that the --readonly flag does not restrict IAM permissions. Consequently, any stolen credentials retain full authority granted by the underlying IAM policy.
Infection and persistence in general
Security analysts typically examine server logs for unusual outbound connections to unknown endpoints when investigating server-side request forgery. These flaws often allow attackers to pivot through internal networks by forcing the server to make requests on their behalf. Persistence in these scenarios usually relies on the continued validity of stolen credentials rather than installed malware. Teams should check whether the compromised service has access to sensitive resources and monitor for unexpected data exfiltration patterns.
Background: CVE identifiers
A CVE identifier is a unique string assigned to a publicly disclosed security vulnerability. It acts as a common name so vendors, tools, and researchers can discuss the same flaw without confusion. The ID itself carries no severity rating, timeline, or patch availability information.
Read the full guide: CVE Identifiers Explained: How Vulnerability Tracking Actually Works
What to do and how to stay safe: AWS
- Upgrade the AWS HealthLake MCP Server to version 0.0.14 or later immediately.
- Restrict the IAM policy used by the server to least privilege instead of using Resource: "*".
- Rotate credentials for affected roles if you suspect your deployment was exposed to the flaw.
- Do not rely on the --readonly flag as a security boundary for IAM controls.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-15643?
It is a server-side request forgery vulnerability in the AWS HealthLake MCP Server that allows credential theft.
Which versions are affected by this flaw?
All versions of awslabs.healthlake-mcp-server prior to 0.0.14 are affected on all platforms.
Does the --readonly flag prevent this exploit?
No, the --readonly flag is an in-process guard, not an IAM control, so stolen credentials retain full authority.
