In July AWS patched its HealthLake connector, the glue that lets an AI assistant query patient records. A crafted pagination parameter could redirect the server's next request anywhere the attacker liked, its temporary cloud credentials riding along.
Run it with --readonly and the ceiling on damage looks like a leaked query. AWS's bulletin says the flag is "an in-process guard over the mutating tools, not an IAM control, so disclosed credentials retain their full granted authority."
The flag governed what the server would do with its keys. It had no opinion about what a stranger holding them could do, which was everything the account's permissions policy allowed.
Every connector you've shipped invites the same question: is read-only enforced by the permissions policy, or by the tool's own manners?
The flaw: CVE-2026-15643, a server-side request forgery in pagination handling of the AWS HealthLake MCP server — the interface an assistant calls to reach the records.
Fix: version 0.0.14 or later, including forks and derivative code.
Precondition: an authenticated remote user, not open-internet access.
Severity: Amazon-assigned CVSS v4 of 9.2; NIST's independent enrichment still pending at publication.
AWS's workarounds: scope the server's IAM policy to least privilege rather than Resource: "*"; rotate credentials if a vulnerable version may have run.
Not the first: an earlier AWS API MCP server flaw (fixed in 1.3.9) let a file-access restriction be bypassed, exposing local file contents to the client.