# CVE-2026-34359: HAPI FHIR credential leakage via improper URL prefix matching

Source: https://junglewise.ai/threats/cve-2026-34359-hapi-fhir-credential-leakage-via-improper-url-prefix-matching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34359 · Severity: high · CVSS 7.4 · Published 2026-03-31

HAPI FHIR is a Java-based library used by healthcare organizations to exchange and validate medical data. A security flaw in how the library handles server connections allows sensitive login credentials—such as API keys and passwords—to be sent to malicious websites. This occurs when the software is tricked by a specially crafted web address that looks similar to a trusted healthcare server, potentially allowing an attacker to steal credentials and impersonate legitimate users.

Technologies: [Hapifhir Hl7 Fhir Core](https://junglewise.ai/threats/technologies/hl7-fhir-core), [ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-core), [ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven)](https://junglewise.ai/threats/technologies/ca-uhn-hapi-fhir-org-hl7-fhir-utilities). Vendors: [Hapifhir](https://junglewise.ai/threats/vendors/hapifhir), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-34359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34359 being exploited in the wild.

**How severe is CVE-2026-34359?** High severity, with a CVSS score of 7.4, published 31 March 2026.

**Which products and versions are affected?** HAPI FHIR FHIR Core Tools < 6.9.4; ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) ECOSYSTEM:introduced=0,fixed=6.9.4; ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven) ECOSYSTEM:introduced=0,fixed=6.9.4.

**Is there a fix for CVE-2026-34359?** Yes. ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven): upgrade to 6.9.4 or later; ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34359 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34359?** Check whether you run HAPI FHIR FHIR Core Tools, Hapifhir Hl7 Fhir Core, ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ca.uhn.hapi.fhir:org.hl7.fhir.core (Maven): upgrade to 6.9.4 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.core to 6.9.4 in your pom.xml or build.gradle
  ```

- ca.uhn.hapi.fhir:org.hl7.fhir.utilities (Maven): upgrade to 6.9.4 or later

  ```sh
  # set ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.4 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in `ManagedWebAccessUtils.getServer()` within the `org.hl7.fhir.utilities` module. The component uses `String.startsWith()` to match request URLs against configured server URLs for credential dispatch without verifying host boundaries or trailing slashes. Consequently, if a trusted server is configured as `http://tx.fhir.org`, an attacker-controlled domain like `http://tx.fhir.org.attacker.com` will trigger a prefix match. When the HTTP client follows a redirect to the malicious domain, it automatically attaches Bearer tokens, Basic auth credentials, or API keys to the request. This issue has been patched in version 6.9.4 by implementing proper host boundary validation.

## Affected products

- hapifhir org.hl7.fhir.core (org.hl7.fhir.utilities) < 6.9.4

## Identifiers

- CVE-2026-34359
- GHSA-fgv2-4q4g-wc35

## Timeline

- 2026-03-27: advisory: GitHub Security Advisory published by maintainers
- 2026-03-31: disclosed: CVE-2026-34359 published to NVD
- 2026-03-31: patched: Fix released in version 6.9.4

## References

- [https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fgv2-4q4g-wc35](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fgv2-4q4g-wc35)

## Related threats

- [HAPI FHIR XXE injection in XsltUtilities saxonTransform](https://junglewise.ai/threats/cve-2026-55471-hapi-fhir-xxe-injection-in-xsltutilities-saxontransform)
- [HAPI FHIR SSRF and credential leak in FHIR Validator](https://junglewise.ai/threats/cve-2026-34361-hapi-fhir-ssrf-and-credential-leak-in-fhir-validator)
- [HAPI FHIR SSRF in FHIR Validator /loadIG endpoint](https://junglewise.ai/threats/cve-2026-34360-hapi-fhir-ssrf-in-fhir-validator-loadig-endpoint)
- [HAPI FHIR sensitive information leak via HTTP redirects](https://junglewise.ai/threats/cve-2026-33180-hapi-fhir-sensitive-information-leak-via-http-redirects)
- [XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`](https://junglewise.ai/threats/cve-2024-52007-xxe-vulnerability-in-xslt-parsing-in-org-hl7-fhir-core)