Executive brief
HAPI FHIR is a Java-based implementation of the HL7 FHIR standard used for exchanging healthcare data between different systems. A security flaw in its validation service allows an unauthenticated attacker to force the server to make unauthorized network requests to internal systems or cloud metadata services. This could allow an attacker to map out a private corporate network, identify internal services, or gain information about the cloud environment where the application is hosted.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the /loadIG HTTP endpoint of the HAPI FHIR Validator service. The root cause is a lack of hostname, scheme, or domain validation in the LoadIGHTTPHandler and IgLoader components when processing user-supplied URLs in a JSON body. By default, the application's domain allowlist is empty and defaults to permitting all destinations. Furthermore, the SimpleHTTPClient follows redirects without re-validating the new target against the allowlist. An unauthenticated attacker can exploit this to perform blind SSRF, using error-based information leakage (e.g., connection refused vs. parse errors) to map internal network topology or access cloud metadata endpoints (169.254.169.254). The vulnerability is patched in version 6.9.4.
Affected products
- hapifhir HAPI FHIR (org.hl7.fhir.core) < 6.9.4
Timeline
- 2026-03-27: advisory: GitHub Security Advisory published by maintainers
- 2026-03-31: disclosed: CVE-2026-34360 published to NVD
- 2026-03-31: patched: Fix released in version 6.9.4