CVE-2026-34360 HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname,...

CVE-2026-34360

CVE-2026-34360 / GHSA-3WW8-JW56-9F5H : The FHIR Validator HTTP service exposes an unauthenticated /loadIG endpoint that can perform blind SSRF. Root cause: user-supplied IG URL is not validated; allowedDomains is empty by default, and redirects aren’t re-validated, enabling requests to internal n...