CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL
Healthlake Mcp ยท 2026-07-14
Actions
Technical Details
| Affected Versions | < 0.0.14 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-15643 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update AWS HealthLake MCP Server to version 0.0.14 to address the SSRF vulnerability (CVE-2026-15643) and ensure pagination URLs are validated, reducing the risk of credential exfiltration.
For Platform Teams
Deploy the patched version of AWS HealthLake MCP Server to enhance security and prevent unauthorized access to AWS temporary security credentials via SSRF attacks.
For Executives
Implement the latest version of AWS HealthLake MCP Server to mitigate the risk of server-side request forgery and potential credential exfiltration, ensuring the security and integrity of your AWS HealthLake FHIR datastores.