CVE-2026-49120
Last modified
CVE-2026-49120 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-49120?
How severe is CVE-2026-49120?
How do I fix CVE-2026-49120?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49110Unauthenticated Broken Authentication in Upsell Order Bump O…7.5
- CVE-2026-49111Incorrect Privilege Assignment vulnerability in ThemeGrill M…8.8
- CVE-2026-49112Unauthenticated Path Traversal in Shared Files <= 1.7.64 ver…7.5
- CVE-2026-49113Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 v…8.5
- CVE-2026-49119Gradio before 6.16.0 contain a path traversal vulnerability …8.7
- CVE-2026-4912The Media Cleaner: Clean your WordPress! plugin for WordPres…4.1
- CVE-2026-49121AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an…9.8
- CVE-2026-49127Music Player Daemon (MPD) before version 0.24.11 contains a …8.8
- CVE-2026-49128Music Player Daemon (MPD) before version 0.24.11 contains a …8.7
- CVE-2026-49129Music Player Daemon (MPD) before version 0.24.11 contains a …6.9
- CVE-2026-4913Improper protection of an alternate path in Ivanti N-ITSM be…5.7
- CVE-2026-49130Music Player Daemon (MPD) before version 0.24.11 contains a …6.9
Are you affected by CVE-2026-49120?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST