CVE-2026-34361 Details
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This issue has been patched in version 6.9.4.
A vulnerability in HAPI FHIR's implementation of the HL7 FHIR standard for healthcare interoperability in Java, prior to version 6.9.4, exposes an unauthenticated Server-Side Request Forgery (SSRF) via the '/loadIG' endpoint of the FHIR Validator HTTP service. This endpoint allows outbound HTTP requests to URLs controlled by attackers. The vulnerability arises from a combination of the unrestricted '/loadIG' endpoint, which accepts URLs without validation, and a flaw in the credential management that uses prefix matching to determine when to send authentication tokens. As a result, an attacker could steal authentication tokens, such as Bearer tokens, Basic auth credentials, or API keys, for legitimate FHIR servers by registering a domain that prefix-matches a server URL. This stolen data could then be used to access protected FHIR endpoints or publish malicious packages to FHIR registries, impacting downstream consumers.
Users are advised to update to HAPI FHIR version 6.9.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-vr79-8m62-wh98 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hapifhir hl7 fhir core | < 6.9.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |