CVE-2026-41258

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows unrestricted Java reflection through template expressions. A user with the Manage Concepts privilege can store a malicious Velocity template expression in a concept's reference range criteria field. This payload is then executed automatically whenever a user or API call validates an observation against the affected concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer). This vulnerability is fixed in 2.7.9 and 2.8.6.

• CWE-94

• https://github.com/openmrs/openmrs-core/security/advisories/GHSA-xj4f-8jjg-vx4q

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41252xrdp is an open source RDP server. Versions 0.10.6 and prior…9.8
• CVE-2026-41253In iTerm2 through 3.6.9, displaying a .txt file can cause co…7.8
• CVE-2026-41254Little CMS (lcms2) through 2.18 has an integer overflow in C…7.5
• CVE-2026-41255CKAN is an open-source DMS (data management system) for powe…6.1
• CVE-2026-41256jq is a command-line JSON processor. In 1.8.1 and earlier, T…5.5
• CVE-2026-41257jq is a command-line JSON processor. In 1.8.1 and earlier, t…5.5
• CVE-2026-41259Mastodon is a free, open-source social network server based …7.5
• CVE-2026-4126The Table Manager plugin for WordPress is vulnerable to Sens…4.3
• CVE-2026-41263Traefik is an HTTP reverse proxy and load balancer. Prior to…3.7
• CVE-2026-41264Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41265Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2026-41266Flowise is a drag & drop user interface to build a customize…7.5