AWS HealthOmics MCP Server Path Traversal in Workflow Linting Tools
First seen Jul 19, 2026 · Updated Jul 19, 2026 · CVSS 5.5
AWS HealthOmics MCP Server's linting tools failed to properly restrict pathnames, allowing an actor who can influence the MCP agent's workflow_files input to write attacker-controlled content outside the intended workflow bundle directory via directory traversal sequences. This is a classic path traversal vulnerability exposed through an MCP tool interface rather than a novel agent-specific attack, and is fixed in version 0.0.36.
Technical Analysis
The vulnerability lies in the linting tool component of the aws-healthomics-mcp-server, which accepts a workflow_files input that is insufficiently sanitized before being used to construct filesystem paths. An attacker who can supply or influence workflow_files content (e.g., via a compromised upstream data source, malicious workflow bundle, or an agent that passes untrusted user input through to the tool) can embed directory traversal sequences (e.g., '../../') to cause the server to write files outside the intended sandboxed workflow bundle directory. This crosses the tool-boundary trust assumption: the MCP server treats workflow_files as data confined to a bundle directory, but the flaw lets that data escape into arbitrary filesystem locations, potentially overwriting sensitive files or planting malicious content that could later be executed or read by other processes on the host. The attacker gains arbitrary-location file write capability scoped to the permissions of the MCP server process, which in a clinical/genomics pipeline context could lead to data corruption, workflow tampering, or a foothold for further compromise.
Affected Systems
aws-healthomics-mcp-server; protocols: MCP
Detection Signatures
- Log entries showing workflow_files parameters containing '../' or '..\\' sequences or absolute path prefixes
- File write operations by the HealthOmics MCP server process occurring outside the configured workflow bundle directory
- Unexpected file creation/modification in paths outside /workflow-bundle or equivalent sandbox root
- MCP tool invocations to linting tools with anomalous or unescaped path-like strings in input fields
- Monitoring for aws-healthomics-mcp-server versions prior to 0.0.36 in deployment inventories
Remediation Steps
- 1
Upgrade the MCP server
Update aws-healthomics-mcp-server to version 0.0.36 or later, which contains the fix for the path traversal vulnerability.
- 2
Input validation and sanitization
Ensure any custom wrappers or integrations around the MCP server canonicalize and validate workflow_files paths against an allow-listed base directory before passing them to linting tools.
- 3
Least-privilege file system permissions
Run the MCP server process under a restricted service account with write access limited only to the intended workflow bundle directory.
- 4
Audit and monitor
Review logs for historical use of the vulnerable version to identify any files that may have been written outside the intended directory, and monitor future tool invocations for traversal patterns.
- 5
Restrict untrusted input paths
If agents or upstream systems can supply workflow_files values, treat these as untrusted external input and apply strict schema/path validation before forwarding to the MCP server.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.