PT-2026-45843 · Medplum · Medplum

Katriel Moses + 1 · CVE-2026-49120 · Published 2026-06-02 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.14

Description An issue in the subscription worker allows authenticated users to perform unauthorized internal network requests. By creating FHIR Subscription resources with arbitrary endpoint URLs, attackers can target internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints. This can lead to the exfiltration of IAM credentials and patient health records through the POST body, which contains full FHIR resource payloads. Server-Side Request Forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location.

Recommendations Update to version 5.1.14 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49120

Affected Products

Medplum

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49120.json · Exploit
• https://github.com/medplum/medplum/commit/87595e98d756d840d70d9dc87beb9d4f9e158b59 · Patch
• https://osv.dev/vulnerability/CVE-2026-49120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49120 · Security Note
• https://github.com/medplum/medplum/releases/tag/v5.1.14 · Note
• https://github.com/medplum/medplum · Note
• https://github.com/medplum/medplum/pull/9334 · Note
• https://vulncheck.com/advisories/medplum-ssrf-via-fhir-subscription-endpoint · Note
• https://twitter.com/VulmonFeeds/status/2061926034677600666 · Twitter Post
• https://twitter.com/disismohi/status/2062416058988872148 · Twitter Post