CVE-2026-15415

Received Received - Intake

Path Traversal in AWS HealthOmics MCP Server

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: AMZN

Description

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research. Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow_files input. To remediate this issue, users should upgrade to version 0.0.36 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-15415

EUVD

EUVD-2026-45298

Affected Vendors & Products

Vendor	Product	Version / Range
aws	aws_healthomics_mcp_server	0.0.36
aws	aws-healthomics-mcp-server	to 0.0.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal and arbitrary file write issue in the workflow linters of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36. It allows an attacker who can influence the MCP agent to write attacker-controlled content to arbitrary locations outside the intended workflow bundle directory by using directory traversal sequences in the workflow_files input.

Detection Guidance

Detection involves checking the version of aws-healthomics-mcp-server. Run 'aws-healthomics-mcp-server --version' or inspect installed packages. Versions prior to 0.0.36 are vulnerable.

Impact Analysis

An attacker could manipulate the MCP agent to overwrite or create malicious files outside the intended directory. This could lead to data corruption, unauthorized code execution, or compromise of the workflow environment. The impact is limited to data integrity as confidentiality and availability are not affected.

Compliance Impact

This vulnerability could impact compliance with HIPAA since AWS HealthOmics is HIPAA-eligible. Unauthorized file writes outside the workflow bundle directory may lead to data integrity issues, potentially violating HIPAA's requirements for protecting sensitive health information. Users should upgrade to version 0.0.36 or later to maintain compliance.

Mitigation Strategies

Upgrade aws-healthomics-mcp-server to version 0.0.36 or later immediately. No workarounds exist, so patching is required. Verify the upgrade with version checks.

Hi! I’m here to help you understand CVE-2026-15415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70