CVE-2026-49120: Medplum SSRF via FHIR Subscription – Healthcare Data & Credentials at Risk

Technical summary

CVE-2026-49120 is a server-side request forgery (SSRF) vulnerability in Medplum's subscription worker component. The flaw exists because the system does not properly validate endpoint URLs when processing FHIR Subscription resources created by authenticated users. An attacker can exploit this by crafting a Subscription with a malicious endpoint URL pointing to internal resources (e.g., 169.254.169.254 for AWS metadata, internal database IPs, or Kubernetes API endpoints). When the subscription worker processes events, it issues POST requests containing full FHIR resource payloads to the attacker-controlled endpoint, leaking sensitive data including IAM credentials and Protected Health Information (PHI). The vulnerability requires valid authentication to the Medplum instance but does not require administrative privileges, significantly lowering the barrier to exploitation.

Business impact

For healthcare organizations deploying Medplum, this vulnerability creates a direct path to credential and PHI theft. An insider with standard user credentials—or an external attacker with compromised credentials—can access cloud provider metadata services to obtain temporary credentials for lateral movement, or directly query internal databases and orchestration systems. The exfiltration of patient records violates HIPAA and exposes the organization to regulatory fines, reputational damage, and patient notification obligations. In cloud-native deployments (Kubernetes, container registries), this can serve as a pivot point for container escape or supply-chain compromise.

Affected systems

Medplum instances running versions prior to 5.1.14 are affected. The vulnerability requires an authenticated user account, so air-gapped or strictly access-controlled Medplum instances face lower immediate risk. However, any deployment permitting standard user account creation or federated authentication is at risk. Healthcare SaaS providers hosting Medplum on behalf of multiple clients face compounded risk due to cross-tenant implications if subscription resources are not properly isolated.

Exploitability

The barrier to exploitation is moderate. An attacker needs valid authentication credentials (username/password, API key, or federated identity) to create a malicious Subscription resource. However, this does not require administrative access, and many healthcare deployments distribute user accounts freely to clinicians, billing staff, and administrative personnel. Once authenticated, the attacker can create a Subscription in seconds through the standard FHIR API. The subscription worker processes events asynchronously; exploitation does not require real-time interaction, making detection challenging. No patch installation or complex infrastructure is needed on the attacker side—only a listening endpoint to receive exfiltrated data.

Remediation

Upgrade Medplum to version 5.1.14 or later immediately. The fix likely includes URL validation to reject internal IP ranges (RFC 1918 addresses, 127.0.0.1, 169.254.x.x) and enforcement of allow-listing for Subscription endpoints. Pending patching, organizations should review subscription resource configurations and delete any with suspicious or internal endpoints. Implement strict network segmentation to prevent the Medplum server from accessing internal resources; use egress firewall rules and proxy-based controls to block outbound connections to internal IP ranges, cloud metadata services, and orchestration APIs.

Patch guidance

Verify the version of your Medplum deployment (check startup logs or the admin API). If running below 5.1.14, schedule an upgrade in your maintenance window. Consult the Medplum release notes for 5.1.14 to confirm the fix is included and identify any breaking changes. Test the upgrade in a development environment against your FHIR client integrations before production rollout. After upgrading, audit existing Subscription resources in your database for any with unexpected or internal endpoint URLs; remove or disable them.

Detection guidance

Monitor outbound network traffic from Medplum processes for POST requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata services (169.254.169.254, 169.254.169.253). Audit FHIR Subscription creation and modification events in your application logs, filtering for endpoints that do not match your organization's approved list. Alert on any Subscription with an endpoint containing an internal IP, localhost, or known metadata service address. If your Medplum logs include the POST body or response, search for exfiltrated credential patterns (AWS session tokens, database connection strings, IAM role metadata). Correlation with egress firewall denies may indicate failed exploitation attempts.

Why prioritize this

This vulnerability merits immediate prioritization due to the convergence of high-severity impact (confidentiality breach of PHI and credentials), low attack complexity (standard authenticated user), and the sensitive nature of Medplum deployments. Healthcare organizations face regulatory and reputational consequences that dwarf most software vulnerabilities. The lack of CISA KEV designation does not diminish the actual risk—active exploitation in healthcare supply chains is plausible and likely underreported.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects a network-accessible vulnerability that requires low-privileged authentication but has high confidentiality impact and cross-boundary scope implications (changing trust boundaries via access to internal resources). The score appropriately captures the severity; however, for healthcare organizations, the true business risk is higher due to regulatory obligations and the sensitive nature of the data at stake.

Frequently asked questions