TI-2026-26646 Aliases CVE-2026-34360 GHSA-3ww8-jw56-9f5h

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HIGH 65CWE-918Published 2026-03-31 · Updated 2026-04-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00244 15th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.hl7.fhir.core (hapifhir): 6.9.4ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven): 6.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hapifhir	org.hl7.fhir.core	before 6.9.4	6.9.4	Patch available	CNA
—	ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven)	before 6.9.4	6.9.4	Patch available	GHSA-3ww8-jw56-9f5h

org.hl7.fhir.core Vendorhapifhir Affected before 6.9.4 Fixed in 6.9.4 Patch available CNA
ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) Vendor— Affected before 6.9.4 Fixed in 6.9.4 Patch available GHSA-3ww8-jw56-9f5h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hapifhir:hl7_fhir_core::::::::	before 6.9.4	Vulnerable	hapifhir

cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:* Versions before 6.9.4 Vulnerable ·hapifhir

Remediation

Fix · CNA org.hl7.fhir.core (hapifhir) Fixed in 6.9.4
Fix · GHSA-3ww8-jw56-9f5h ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) Fixed in 6.9.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-34360
2026-10-03 Alias added: GHSA-3ww8-jw56-9f5h

References

TI-2026-26647 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVSS 3.1CRITICAL 9.3
TI-2026-40028 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVSS 4.0HIGH 8.7
TI-2026-26645 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVSS 3.1CRITICAL 9.1
TI-2026-40027 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS CVSS 3.1HIGH 7.5
TI-2023-09835 HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files… CVSS 3.1HIGH 8.1
TI-2023-13005 The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences