GHSA-VR79-8M62-WH98 FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

🗓️ 30 Mar 2026 17:24:10Reported by GoogleType

osv🔗 osv.dev👁 4 Views

SSRF in the FHIR Validator HTTP service enables token leakage via the loadIG endpoint and a startsWith credential-matching flaw.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2026-34361	31 Mar 202616:56	–	attackerkb
Circl	CVE-2026-34361	27 Mar 202613:35	–	circl
CNNVD	HAPI FHIR 安全漏洞	31 Mar 202600:00	–	cnnvd
CVE	CVE-2026-34361	31 Mar 202616:56	–	cve
Cvelist	CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft	31 Mar 202616:56	–	cvelist
Github Security Blog	FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft	30 Mar 202617:24	–	github
GitLab Advisory Database	FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft	30 Mar 202600:00	–	gitlab
NVD	CVE-2026-34361	31 Mar 202617:16	–	nvd
OSV	CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft	31 Mar 202616:56	–	osv
OSV	ROOT-APP-MAVEN-CVE-2026-34361 CVE-2026-34361 in io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root	24 Jun 202610:45	–	osv

Source	Link
github	www.github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-vr79-8m62-wh98
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34361
github	www.github.com/hapifhir/org.hl7.fhir.core

31 Mar 2026 19:05Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.3

EPSS0.00299