CVE-2026-47664: Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local file:// imports - bypassing the configured allowableSources allowlist that protects the ordinary $import operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the $import-pnp operation (pathling.operations.importPnpEnabled=false) or do not configure PNP credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.0 - Configuration
Disable the $import-pnp operation by setting pathling.operations.importPnpEnabled=false (workaround).
Pathling Server ($import-pnp operation) pathling.operations.importPnpEnabled = false - Configuration
Do not configure PNP credentials.
Pathling Server (PNP credentials) PNP credentials configuration = not configured
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47664?
CVE-2026-47664 has a risk score of 55, indicating a moderate level of severity.
How do I fix CVE-2026-47664?
To mitigate CVE-2026-47664, upgrade Pathling Server to version 2.0.0 or later.
What type of vulnerability is CVE-2026-47664?
CVE-2026-47664 is an SSRF vulnerability that can lead to credential leakage and data poisoning.
What impact does CVE-2026-47664 have?
CVE-2026-47664 allows authenticated users to exploit the `$import-pnp` operation, potentially resulting in unauthorized access to sensitive data.
What should I do if I cannot upgrade to fix CVE-2026-47664?
If upgrading is not possible, implement strict input validation on the `exportUrl` parameter to reduce the risk of exploitation.