https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T22:20:59.929895+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-15643 CVE-2026-15643 — AWS HealthLake MCP Server SSRF via Pagination URL 2026-10-18T22:20:59.930957+00:00

Affected: awslabs.healthlake-mcp-server

AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server.

Its recommended to upgrade to version 0.0.14 or later.