HAPI FHIR Vulnerability: Sensitive Credentials Exposed During HTTP Redirects
CVE-2026-33180: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Summary
A vulnerability was discovered in the Java implementation of HAPI FHIR, which implements the HL7 FHIR standard. Prior to version 6.9.0, sensitive HTTP headers, such as authentication credentials, could be leaked to unintended hosts during an HTTP redirect (30X response).
Key Players
Details
HAPI FHIR is a complete Java implementation of the HL7 FHIR standard for healthcare interoperability. The vulnerability lies in how the internal HTTP client handles redirects. In versions prior to 6.9.0, when following a 30X HTTP redirect, the same set of headers—including potentially sensitive or authentication-related data—that were sent initially are also transmitted to the new host specified in the Location header. This unintended transmission poses a risk of unauthorized disclosure of private information or credentials, potentially allowing attackers to impersonate the client. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information) and carries a CVSS 3.1 base score of 7.5 (High). The impact is limited to confidentiality loss only. Mitigation requires upgrading to HAPI FHIR version 6.9.0 or later, as no known workarounds are available.
Technology Note
FHIR（Fast Healthcare Interoperability Resources）は医療データ交換の国際標準。このエントリの関連技術: HL7
Original content copyright by respective publishers