https://seclists.org/oss-sec/2026/q3/715: CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE

Q: Which installations should be treated as affected?

Mirth Connect 4.7.1 and earlier are affected. Upgrading to 4.7.2 or later fixes all three vulnerabilities.

Q: What access does an attacker need to exploit the database issue?

The SQL injection requires authentication and is reached through POST /api/connectors/jdbc/_getTables. The selectLimit parameter is executed as arbitrary SQL.

Q: What could the SQL injection expose or disrupt?

On the bundled Derby database, it can export live database contents, including administrator password hashes and channel configurations containing plaintext connector credentials, to a web path retrievable without authentication. It can also freeze database-backed operations until the server is restarted.

Q: When is the XML issue reachable without authentication?

It is reachable when a channel that accepts attacker-supplied inbound XML uses an affected XSLT Transformer Step. A crafted message can exfiltrate a server-local file through an attacker-controlled callback.

Published Sep 11, 2026

Updated

Affected Software

1 affected component

NextGen Healthcare Mirth Connect<=4.7.1

Frequently Asked Questions

Which installations should be treated as affected?

Mirth Connect 4.7.1 and earlier are affected. Upgrading to 4.7.2 or later fixes all three vulnerabilities.

What access does an attacker need to exploit the database issue?

The SQL injection requires authentication and is reached through POST /api/connectors/jdbc/_getTables. The selectLimit parameter is executed as arbitrary SQL.

What could the SQL injection expose or disrupt?

On the bundled Derby database, it can export live database contents, including administrator password hashes and channel configurations containing plaintext connector credentials, to a web path retrievable without authentication. It can also freeze database-backed operations until the server is restarted.

When is the XML issue reachable without authentication?

It is reachable when a channel that accepts attacker-supplied inbound XML uses an affected XSLT Transformer Step. A crafted message can exfiltrate a server-local file through an attacker-controlled callback.