CVE-2026-34361: HAPI FHIR SSRF and credential leak in FHIR Validator

CVE-2026-34361 · Severity: critical · CVSS 9.3 · Published 2026-03-31

HAPI FHIR is a Java-based implementation of the HL7 FHIR standard used for healthcare data interoperability. A vulnerability in its validation service allows unauthenticated attackers to trick the system into sending sensitive authentication tokens (such as API keys and passwords) to a server they control. This could lead to the theft of credentials used to access healthcare registries or clinical data repositories, potentially resulting in unauthorized access to patient health records.

Technologies: Hapifhir Hl7 Fhir Core, ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven). Vendors: Hapifhir, Maven.

Quick answers

Is CVE-2026-34361 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34361 being exploited in the wild.
How severe is CVE-2026-34361?
Critical severity, with a CVSS score of 9.3, published 31 March 2026.
Which products and versions are affected?
HAPI FHIR FHIR Core Validation Resources < 6.9.4; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) ECOSYSTEM:introduced=0,fixed=6.9.4.
Is there a fix for CVE-2026-34361?
Yes. ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34361 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34361?
Check whether you run HAPI FHIR FHIR Core Validation Resources, Hapifhir Hl7 Fhir Core or ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.4 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.4 in your pom.xml or build.gradle

Technical details

The FHIR Validator HTTP service exposes an unauthenticated '/loadIG' endpoint that accepts an 'ig' parameter and passes it to IgLoader.loadIg() without validation, leading to Server-Side Request Forgery (SSRF). A secondary flaw exists in ManagedWebAccessUtils.getServer(), which uses a startsWith() comparison to determine if credentials should be attached to an outbound request. An attacker can register a domain that prefix-matches a legitimate configured FHIR server (e.g., 'legit-server.com.attacker.com') to capture Bearer tokens, Basic auth credentials, or API keys. The vulnerability is further amplified by the SimpleHTTPClient manually following redirects and re-evaluating credential attachment on each hop. The issue is fixed in version 6.9.4 by implementing proper URL origin comparison.

Affected products

  • hapifhir org.hl7.fhir.validation < 6.9.4

Identifiers

  • CVE-2026-34361
  • GHSA-vr79-8m62-wh98

Timeline

  • 2026-03-27: advisory: GitHub Security Advisory published
  • 2026-03-31: disclosed: CVE published to NVD
  • 2026-03-31: patched: Fix released in version 6.9.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.