{"data":{"id":"20efd7c8-68ac-427f-8fa2-a14dd3555f04","title":"CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server","summary":"AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.","solution":"Update aws-healthomics-mcp-server to version 0.0.36 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-060-aws/","publishedAt":"2026-07-17T19:44:21.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS","AWS HealthOmics","aws-healthomics-mcp-server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-17T19:44:21.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}