CVE-2026-50576: ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The buildinnerheader function interpolates the uri, host, accepttype, contenttype, contentlength, USERAGENT, and insurantid values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USERAGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ePA 3.x Integrationto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Which deployments need remediation?
Deployments running versions before 1.3.0 are affected. The issue is fixed in version 1.3.0.
What access and input control does an attacker need?
An attacker must be authenticated and able to control a value interpolated into a VAU inner request, such as uri, host, accept_type, content_type, content_length, USER_AGENT, or insurant_id. Exploitation requires CRLF characters in that controlled value to inject additional HTTP headers.
What could successful header injection enable?
Potential effects depend on how the ePA server processes injected headers. An injected x-insurantid header may expose another patient's records, while injected Authorization headers may bypass the intended authentication or authorization context; session-derived USER_AGENT input may poison requests across the session.