Server-Side Request Forgery in HAPI FHIR Validator HTTP Service

CVE-2026-34360

What is CVE-2026-34360?

The HAPI FHIR Validator HTTP service contains a vulnerability that exposes it to server-side request forgery (SSRF) due to inadequate validation of user-supplied URLs. Specifically, the /loadIG endpoint permits unauthenticated attackers on the network to exploit this by submitting a crafted JSON request. This action allows them to make unauthorized HTTP requests, potentially accessing sensitive internal services and revealing network configurations through error-based information leakage. This vulnerability, discovered in versions prior to 6.9.4, significantly enhances an attacker's capability to conduct reconnaissance activities, as each request may trigger multiple outbound calls to various targets, amplifying the risk. Users are strongly advised to upgrade to version 6.9.4 or later to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References