PT-2026-60846 · Aws · Aws-Healthomics-Mcp-Server

CVE-2026-15415 · Publicado 2026-07-17 · Atualizado 2026-07-17

NVD

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research.

Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow files input.

To remediate this issue, users should upgrade to version 0.0.36 or later.

Correção

Relative Path Traversal

Enumeração de Fraquezas

CWE-23

Identificadores relacionados

CVE-2026-15415

Produtos afetados

Aws-Healthomics-Mcp-Server

Referências · 4

• https://github.com/awslabs/mcp/security/advisories/GHSA-6x7f-488g-75wm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-15415 · Nota de Segurança
• https://pypi.org/project/awslabs.aws-healthomics-mcp-server/0.0.36 · Correção
• https://aws.amazon.com/security/security-bulletins/2026-060-aws · Aviso do Fabricante