Read the docs
TI-2026-26647 Aliases CVE-2026-34361GHSA-vr79-8m62-wh98

HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

Priority HIGH 79CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-552.

Summary

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This issue has been patched in version 6.9.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.hl7.fhir.core (hapifhir): 6.9.4ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): 6.9.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapifhirorg.hl7.fhir.corebefore 6.9.46.9.4Patch availableCNA
—ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven)before 6.9.46.9.4Patch availableGHSA-vr79-8m62-wh98
  • org.hl7.fhir.core Vendorhapifhir Affected before 6.9.4 Fixed in 6.9.4 Patch available CNA
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) Vendor— Affected before 6.9.4 Fixed in 6.9.4 Patch available GHSA-vr79-8m62-wh98

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*before 6.9.4Vulnerablehapifhir
  • cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:* Versions before 6.9.4 Vulnerable ·hapifhir

Remediation

  • Fix · CNA org.hl7.fhir.core (hapifhir) Fixed in 6.9.4
  • Fix · GHSA-vr79-8m62-wh98 ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) Fixed in 6.9.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34361
  2. 2026-10-03 Alias added: GHSA-vr79-8m62-wh98

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-40028 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVSS 4.0HIGH 8.7
  • TI-2026-26645 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core CVSS 3.1CRITICAL 9.1
  • TI-2026-40027 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS CVSS 3.1HIGH 7.5
  • TI-2023-09835 HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files… CVSS 3.1HIGH 8.1
  • TI-2023-13005 The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before… CVSS 3.1HIGH 7.5
  • TI-2026-26646 HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences