HAPI FHIR Vulnerability: Risk of Authentication Token Theft
CVE-2026-34361 | Mondoo Vulnerability Intelligence Mondoo CVE-2026-34361 - CRITICAL severity:
A critical SSRF vulnerability (CVE-2026-34361) was identified in HAPI FHIR related to the /loadIG Chains endpoint.
Summary
The HAPI FHIR Validator HTTP service, which has an unauthenticated endpoint (/loadIG) that sends outbound HTTP requests, can be exploited. This flaw, combined with a startsWith() URL prefix matching vulnerability in the credential provider, allows attackers to steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers.
Key Players
Details
HAPI FHIR is a comprehensive Java implementation of the HL7 FHIR standard for healthcare interoperability. The vulnerability resides in the FHIR Validator HTTP service prior to version 6.9.4. This service exposes an unauthenticated "/loadIG" endpoint, which makes outbound HTTP requests to attacker-controlled URLs. Compounding this issue is a startsWith() URL prefix matching flaw within the credential provider (ManagedWebAccessUtils.getServer()). By registering a domain that prefix-matches a configured server URL, an attacker can steal authentication tokens—such as Bearer, Basic, or API keys—intended for legitimate FHIR servers. This critical vulnerability was patched in version 6.9.4. Given the increasing reliance on FHIR standards for data exchange in Japanese healthcare IT systems, this type of credential leakage risk is highly serious. Developers must ensure they update to the latest patched version (6.9.4 or later) to eliminate this security vulnerability.
Technology Note
FHIR（Fast Healthcare Interoperability Resources）は医療データ交換の国際標準。このエントリの関連技術: FHIR
Original content copyright by respective publishers