Critical severity · published Mar 31, 2026
CVE-2026-34361
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This issue has been patched in version 6.9.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
org.hl7.fhir.core · hapifhir
< 6.9.4 · source: vendor
HF
Hl7 Fhir Core · Hapifhir
before 6.9.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34361
Exploit
https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-vr79-8m62-wh98
More from org.hl7.fhir.core
9.1
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
9.1
CVE-2026-34359
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
8.6
CVE-2024-45294
`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
7.5
CVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
7.5
CVE-2026-81875
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service