CVE-2026-45574: Oviva epa4all-client improper TLS certificate validation

CVE-2026-45574 · Severity: high · CVSS 8.1 · Published 2026-05-26

A security flaw in the epa4all-client, a tool used for electronic patient records in the German Telematik Infrastructure, allows attackers to intercept sensitive medical data. By positioning themselves on the local network, an attacker can bypass encryption to view patient identifiers, medical documents, and digital signatures. This could lead to the exposure of private health information and the unauthorized use of medical identity cards.

Technologies: com.oviva.telematik:epa4all-client (Maven), Oviva Epa4all-Rest-Service, Oviva AG Epa4all-Client. Vendors: Maven, Oviva, Oviva AG.

Quick answers

Is CVE-2026-45574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45574 being exploited in the wild.
How severe is CVE-2026-45574?
High severity, with a CVSS score of 8.1, published 26 May 2026.
Which products and versions are affected?
com.oviva.telematik:epa4all-client (Maven) < 1.2.2, ECOSYSTEM:introduced=0,fixed=1.2.2; Oviva Epa4all-Rest-Service < 1.2.2; Oviva AG Epa4all-Client < 1.2.2.
Is there a fix for CVE-2026-45574?
Yes. com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45574 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-45574?
Check whether you run com.oviva.telematik:epa4all-client (Maven), Oviva Epa4all-Rest-Service or Oviva AG Epa4all-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.oviva.telematik:epa4all-client (Maven): upgrade to 1.2.2 or later
    # set com.oviva.telematik:epa4all-client to 1.2.2 in your pom.xml or build.gradle

Technical details

The epa4all-client library (and its associated REST service) suffers from improper certificate validation (CWE-295). Prior to version 1.2.2, the client does not verify the authenticity of TLS certificates presented by the Konnektor or ePA service, accepting self-signed, expired, or mismatched certificates. An attacker with adjacent network access can perform a Man-in-the-Middle (MitM) attack to intercept SOAP traffic. This traffic contains sensitive data such as patient identifiers (KVNR), document content, and SMC-B card operations (authentication and signing). The vulnerability was addressed in version 1.2.2 by enabling truststore validation by default.

Affected products

  • oviva-ag epa4all-client < 1.2.2
  • oviva-ag epa4all-rest-service (Docker) < 1.2.2

Identifiers

  • CVE-2026-45574
  • GHSA-5hhf-xmfx-4vvr

Timeline

  • 2026-05-08: patched: Fix merged into main branch via Pull Request 36
  • 2026-05-11: advisory: GitHub Security Advisory published
  • 2026-05-26: disclosed: CVE-2026-45574 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.