CVE-2026-34359 is a high severity (CVSS 7.4) flaw in HAPI FHIR core, the Java library for healthcare data. A prefix URL check can send tokens and passwords to an attacker's look-alike domain after a redirect. The fix is version 6.9.4, so upgrade to it or later.
What's affected
The project's advisory (GHSA-fgv2-4q4g-wc35) lists the Maven package org.hl7.fhir.core, in its org.hl7.fhir.utilities module, below 6.9.4 as affected, and 6.9.4 as patched.
The cause is in ManagedWebAccessUtils.getServer(). It matches request URLs against configured server URLs with String.startsWith(). A configured URL such as http://tx.fhir.org has no trailing slash or host boundary, so a domain that begins with the same text, such as that name followed by another label, also matches. If the HTTP client follows a redirect to such a domain, it sends Bearer tokens, Basic credentials or API keys.
A companion record, CVE-2026-34361, covers the validator service that makes this reachable without a login.
How to check if you're exposed
Find the version in your Java build:
mvn dependency:tree | grep hl7.fhir
./gradlew dependencies | grep hl7.fhir
A version below 6.9.4 is affected. Then check whether your configuration holds credentials for terminology or package servers. Without configured credentials there is nothing to leak through this path.
Look at your HTTP client settings as well. If you can turn off automatic redirects, or limit them to the same host, do so for requests that carry credentials.
What to do now
- Find projects that depend on
org.hl7.fhir.coremodules. - Upgrade to 6.9.4 or later and rebuild.
- Rotate tokens and keys configured for FHIR servers if the client could reach outside hosts and followed redirects.
- Restrict outbound traffic from FHIR tooling to the hosts it needs.
- Disable redirects to other hosts where your HTTP client lets you.
Why it matters
The weakness is CWE-346, origin validation error. A safe origin check compares the scheme, host and port exactly. A prefix check on a string is not an origin check, because the text before the match point may continue into a different host name.
The same error appears in redirect allowlists, CORS checks and webhook filters. Parse the URL and compare its host instead. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
When you write code that decides where credentials go, parse the URL and compare the scheme, host and port exactly, or compare against a fixed list of full origins. Add a test with a host that starts with a trusted name and continues with another label. That one case would have caught this bug.
Teams that use HAPI FHIR for validation in build pipelines should check where the credentials live. Tokens kept in a pipeline's environment can be reached by any step that uses the library. If a build only needs public servers, remove the credentials from that job. Fewer secrets in the environment means less to lose when a library bug like this one turns up.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the root cause?
A string prefix match decided where credentials go. A look-alike domain starting with the same text also matched.
Sources
Last reviewed: 19 October 2026.
