AWS Urges Immediate Upgrade to HealthLake MCP 0.0.14 to Patch CVE-2026-15643 Credential Leak

Security teams managing AI assistants that interact with AWS HealthLake datastores face a new credential theft risk. A remote authenticated user can exploit an unvalidated pagination URL in the AWS HealthLake MCP Server to steal temporary AWS security credentials. The attacker needs only valid login access to the server to trigger the exploit, which redirects internal requests to an endpoint they control.

In plain English

The flaw turns the server’s pagination feature into a tool for stealing secrets. When the server processes a request for more data, it uses a token to track progress. An attacker can manipulate this token to point to a malicious server instead of the expected AWS HealthLake endpoint. The server then sends subsequent requests, including its own temporary credentials, to the attacker’s location, effectively handing over access keys.

The background

AWS identified CVE-2026-15643 in its HealthLake MCP Server, a tool that lets AI assistants interact with FHIR datastores. The bulletin, published on July 14, 2026, rates the issue as important. The server failed to validate that pagination URLs pointed back to the legitimate HealthLake service. This lack of validation allowed the redirection of requests to arbitrary endpoints, enabling the exfiltration of credentials before version 0.0.14.

What changes now

AWS has addressed the issue in version 0.0.14 of the awslabs.healthlake-mcp-server. The company recommends upgrading to this latest version immediately. Operators should also ensure that any forked or derivative code incorporates these fixes. If teams suspect they have used an affected version, they should consider rotating the credentials for any role-based deployments to mitigate potential exposure.

What made it possible

Server-side request forgery flaws often arise when applications trust user-supplied input for internal network requests. In this context, the weakness stems from insufficient validation of destination URLs during data retrieval processes. This technique typically serves the initial access or privilege escalation stage of an intrusion, allowing attackers to pivot from a low-privilege interface to sensitive internal resources. Teams usually check whether their servers validate outbound URLs against allowlists to prevent such redirections.

What to do and how to stay safe: AWS

• Verify your current version of the AWS HealthLake MCP Server and upgrade to 0.0.14 or later to apply the official fix.
• Review IAM policies associated with the server to ensure they follow least privilege principles rather than using broad resource permissions.
• Rotate temporary security credentials for any roles that may have been exposed by running an unpatched version of the software.
• Monitor server logs for unusual outbound traffic or requests to unexpected endpoints that could indicate exploitation attempts.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is identified as CVE-2026-15643.

Does the --readonly flag prevent this attack?

No, the --readonly flag is an in-process guard for mutating tools, not an IAM control, so disclosed credentials retain their full granted authority.

Who discovered this issue?

Marios Gyftos collaborated with AWS on this issue through the coordinated vulnerability disclosure process.