EUVD-2026-45298Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because the MCP server runs on the host; no privileges needed to influence agent input; user interaction required to invoke the linting path; integrity-only impact via arbitrary file write.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
1DescriptionCVE.org
AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research.
Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow_files input.
To remediate this issue, users should upgrade to version 0.0.36 or later.
AnalysisAI
Directory traversal in AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 allows an actor who can influence the MCP agent to write attacker-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory via crafted workflow_files input. All pre-0.0.36 versions are affected, with the integrity-only impact (high) and no confidentiality or availability exposure confirmed by the CVSS 4.0 vector. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; Amazon has released a vendor-confirmed patch in version 0.0.36.
Technical ContextAI
The vulnerable component is the linting tooling within the AWS HealthOmics MCP Server, a Model Context Protocol server (PyPI: awslabs.aws-healthomics-mcp-server) that exposes AWS HealthOmics bioinformatics workflow capabilities to AI agents. CWE-23 (Relative Path Traversal) is the root cause: the workflow_files input parameter is used to construct filesystem paths during linting without adequate sanitization or canonicalization, permitting sequences such as '../' to escape the restricted workflow bundle directory and write to arbitrary host filesystem locations. In a typical MCP architecture, the server is a tool-provider consumed by an AI agent; the attack surface is therefore any channel through which an upstream actor can inject malicious path values into the agent's context - including prompt injection, malicious workflow definitions, or other untrusted data processed by the agent.
RemediationAI
Upgrade to aws-healthomics-mcp-server version 0.0.36 or later via pip: 'pip install --upgrade awslabs.aws-healthomics-mcp-server'. The patched package is confirmed available at https://pypi.org/project/awslabs.aws-healthomics-mcp-server/0.0.36/ per the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-060-aws/. If immediate upgrade is not feasible, restrict the sources of workflow_files input to internally-controlled, trusted content only - blocking externally-supplied or user-controlled workflow file paths eliminates the primary exploitation pathway, though this may limit functionality for use cases that rely on external workflow bundles. Additionally, running the MCP server process within a container or Linux namespace with a read-only filesystem mount outside the intended bundle directory will contain any successful traversal until patching is completed, at the cost of operational overhead.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today