AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) before version 0.0.14 contains an SSRF vulnerability in its pagination handling component. The server fails to validate that pagination URLs (via the next_token parameter) point back to the expected HealthLake endpoint, enabling a remote authenticated user to redirect requests to an arbitrary endpoint controlled by an attacker. This flaw could allow exfiltration of AWS temporary security credentials. The vulnerability affects all platforms running versions earlier than 0.0.14. AWS has released version 0.0.14 to address this issue.

A remote authenticated user can exploit the SSRF vulnerability to redirect pagination requests to attacker-controlled endpoints, potentially exfiltrating AWS temporary security credentials. These credentials retain their full granted authority, which could lead to unauthorized access or actions within the AWS environment. The impact is significant due to the potential compromise of temporary credentials, but exploitation requires authentication.

AWS has released version 0.0.14 of awslabs.healthlake-mcp-server to fix this vulnerability. It is recommended to upgrade to this version or later. In the interim, operators should scope IAM policies to least privilege rather than using Resource: "*". The --readonly flag should not be relied upon as a security boundary. Additionally, if an affected version was used, rotating the credentials of the affected role is advised. These steps reduce the risk until the patch is applied.