CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server
Summary
AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.
Solution / Mitigation
Update aws-healthomics-mcp-server to version 0.0.36 or later.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://aws.amazon.com/security/security-bulletins/rss/2026-060-aws/
First tracked: July 17, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%