CVE-2026-15415 is a relative path traversal vulnerability (CWE-23) affecting the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) versions prior to 0.0.36. The flaw allows an attacker who can influence the MCP agent to write actor-controlled content to arbitrary filesystem locations outside the intended workflow bundle directory by exploiting directory traversal sequences in the workflow_files input. This improper limitation of pathname to a restricted directory could lead to unauthorized file writes, potentially impacting the integrity of the system. AWS HealthOmics is a managed cloud service for large-scale bioinformatics workflows. The vulnerability has a CVSS 4.0 base score of 6.8 (medium severity). AWS provides a patch in version 0.0.36 and manages remediation for this cloud service. No known exploits in the wild have been reported as of the publication date.

An attacker able to influence the MCP agent can exploit this vulnerability to write files to arbitrary locations outside the intended workflow directory. This could lead to unauthorized modification or creation of files on the system hosting the MCP server, potentially affecting system integrity or workflow execution. The impact is limited by the requirement that the attacker must have some influence over the MCP agent and local access vector. No direct remote exploitation or privilege escalation is indicated.

A patch is available in aws-healthomics-mcp-server version 0.0.36 that fixes this path traversal vulnerability. Since this is a cloud-hosted service managed by AWS, remediation is typically handled by the vendor. Users should ensure they are running version 0.0.36 or later. Refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-060-aws/ for the latest guidance and updates.