CVE-2026-49120: Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Medplumto a version that resolves this vulnerability.Fixed in 5.1.14 - Configuration
Disable the subscription worker until the Medplum instance is upgraded to 5.1.14 to prevent processing Subscription resources that can trigger SSRF.
Medplum subscription worker enabled = false - Compensating control
Block or restrict outbound network egress from the subscription worker (or host/process running Medplum) to internal IP ranges and metadata service endpoints (for example IMDS endpoints) via firewall, VPC egress rules, or network ACLs.
- Operational
Review existing FHIR Subscription resources and remove or disable any untrusted or unknown endpoints. Audit logs for suspicious subscription creations and POSTs to internal endpoints; rotate any IAM credentials, API keys, or other secrets that may have been exposed and review access to patient records for potential exfiltration.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49120?
CVE-2026-49120 has a medium severity rating of 6.3.
How do I fix CVE-2026-49120?
To remediate CVE-2026-49120, upgrade Medplum to version 5.1.14 or later.
What type of vulnerability is CVE-2026-49120?
CVE-2026-49120 is a server-side request forgery (SSRF) vulnerability.
Who can exploit CVE-2026-49120?
Authenticated users can exploit CVE-2026-49120 by creating FHIR Subscription resources with malicious endpoint URLs.
What potential impact does CVE-2026-49120 have?
CVE-2026-49120 allows unauthorized internal network requests, which could lead to data exposure.