CVE-2026-15415: Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server
AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research.
Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflowfiles input.
To remediate this issue, users should upgrade to version 0.0.36 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws-healthomics-mcp-serverto a version that resolves this vulnerability.Fixed in 0.0.36
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15415?
The severity of CVE-2026-15415 is rated as medium with a score of 5.5.
What vulnerabilities are associated with CVE-2026-15415?
CVE-2026-15415 is associated with path traversal and arbitrary file write vulnerabilities in AWS HealthOmics MCP Server.
How do I fix CVE-2026-15415?
To fix CVE-2026-15415, ensure proper validation and sanitization of file paths to restrict access to designated directories.
What software is affected by CVE-2026-15415?
CVE-2026-15415 affects the Amazon Web Services AWS HealthOmics MCP Server.
When was CVE-2026-15415 published?
CVE-2026-15415 was published on July 17, 2026.