CVE-2026-15415

Name of the Vulnerable Software and Affected Versions aws-healthomics-mcp-server versions prior to 0.0.36

Description Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server allows an actor who can influence the MCP agent to write controlled content to arbitrary locations outside the intended workflow bundle directory. This is achieved through directory traversal sequences in the workflow files input. Directory traversal is a technique that uses special characters to access files and directories that are stored outside the web root folder.

Recommendations Upgrade to version 0.0.36 or later.