CVE-2026-34361 is a critical (CVSS 9.3) flaw in the HAPI FHIR Validator HTTP service. An unauthenticated /loadIG endpoint makes outbound requests to caller-chosen URLs, and a URL matching bug can then leak configured credentials. The fix is version 6.9.4. Restrict who can reach the service.
What's affected
The project's advisory (GHSA-vr79-8m62-wh98) lists the Maven package ca.uhn.hapi.fhir:org.hl7.fhir.validation below 6.9.4 as affected, and 6.9.4 as patched.
Two problems combine. The /loadIG endpoint accepts unauthenticated POST requests with a JSON field naming an implementation guide, and passes it to the loader with no URL validation or allowlist. Separately, the credential lookup in ManagedWebAccessUtils.getServer() uses a startsWith() prefix match, described in CVE-2026-34359.
Together, an outside caller can steer the service to fetch from a domain that prefix-matches a configured server and collect the tokens it sends.
How to check if you're exposed
Check whether you run the validator as an HTTP service, and which version:
mvn dependency:tree | grep hl7.fhir.validation
For a packaged validator, look at the version string it reports. Then check who can reach its port. A service open only to a build pipeline is far safer than one on a public address.
What to do now
- Find any deployment of the FHIR Validator HTTP service.
- Upgrade to 6.9.4 or later.
- Put the service behind authentication, or limit it to trusted networks.
- Rotate tokens and keys configured for FHIR servers if it was reachable from outside.
- Limit outbound traffic from the service to the hosts it needs.
Why it matters
The record lists CWE-552, files or directories accessible to external parties. The deeper pattern is a helper service with no authentication that fetches whatever it is told to, which is server-side request forgery in effect, plus a credential store that decides where to send secrets by string prefix.
Each part would be a smaller issue alone. Combined, they let an outsider turn a configured credential into a stolen one. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
Quick check
Is this the same as CVE-2026-34359?
They are related. That CVE is the URL matching bug. This one is the open endpoint that makes it reachable from outside.
Sources
Last reviewed: 19 October 2026.
