PT-2026-29164 · Hapi Fhir · Hapi Fhir

Offset

·

Published

2026-03-30

·

Updated

2026-03-31

·

CVE-2026-34361

CVSS v3.1

9.3

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.4
Description The HAPI FHIR Validator HTTP service exposes an unauthenticated ''/loadIG'' endpoint that makes outbound HTTP requests to attacker-controlled URLs. This, combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), allows an attacker to steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. The issue involves a Server-Side Request Forgery (SSRF) vulnerability. The LoadIGHTTPHandler.java component accepts unauthenticated POST requests to the ''/loadIG'' endpoint, and the IgLoader.loadIg() function processes the request without URL validation. The ManagedWebAccess component uses the flawed startsWith() logic to determine whether to include credentials in outbound requests. The SimpleHTTPClient component follows redirects, potentially amplifying the credential leakage. An attacker can exploit this by setting up a credential capture server and triggering the SSRF with a prefix-matching URL or a redirect. This could lead to credential theft, supply chain attacks, and data breaches.
Recommendations Update to version 6.9.4 or later. Implement proper URL origin comparison in ManagedWebAccessUtils. Implement URL allowlisting in LoadIGHTTPHandler.

Exploit

Fix

Files Accessible to External Parties

Insufficiently Protected Credentials

Weakness Enumeration

CWE-552CWE-522

Related Identifiers

CVE-2026-34361
GHSA-VR79-8M62-WH98

Affected Products

Hapi Fhir