AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) prior to version 0.0.14 contains an SSRF vulnerability in its pagination handling. The server does not validate that pagination URLs (via the next_token parameter) are restricted to the legitimate HealthLake endpoint, allowing an authenticated remote attacker to redirect requests to arbitrary endpoints. This can lead to exfiltration of AWS temporary security credentials. The vulnerability affects all platforms running versions before 0.0.14. AWS has released version 0.0.14 to address this issue.

An authenticated remote user can exploit this SSRF vulnerability to redirect pagination requests to an attacker-controlled server, potentially exfiltrating AWS temporary security credentials. This could lead to unauthorized access to AWS resources with the permissions granted by those credentials. The severity is rated low by AWS, but credential exfiltration can have significant downstream effects depending on the permissions of the compromised credentials.

AWS has released awslabs.healthlake-mcp-server version 0.0.14 which fixes this vulnerability. Users should upgrade to version 0.0.14 or later. In the interim, operators should scope the IAM policy used by the server to least privilege rather than using Resource: "*". The --readonly flag should not be relied upon as a security boundary. For role-based (STS) deployments, consider rotating the affected role's credentials if an affected version was in use. These mitigations reduce risk until the official fix is applied.