CVE-2026-15477: Bahmni bahmnicore SQL Injection Vulnerability

CVE-2026-15477 Overview

CVE-2026-15477 is a SQL injection vulnerability in Bahmni bahmnicore versions up to 0.93. The flaw resides in the additionalParams function of the /openmrs/ws/rest/v1/bahmnicore/sql endpoint within the Search Endpoint component. Attackers can manipulate the test argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely by authenticated users with low privileges. Public exploit code is available, increasing the likelihood of opportunistic exploitation against healthcare deployments running Bahmni. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject SQL through the Search Endpoint, potentially exposing patient records and other sensitive clinical data stored in the Bahmni database.

Affected Products

Bahmni bahmnicore versions up to and including 0.93
Bahmni bahmnicore 1.0.x prior to 1.0.1, 1.1.x prior to 1.1.1, 1.2.x prior to 1.2.1, and 1.3.x prior to 1.3.1
Bahmni bahmnicore 2.0.x prior to 2.0.1

Discovery Timeline

2026-07-12 - CVE-2026-15477 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15477

Vulnerability Analysis

Bahmni is an open-source hospital and clinic management system built on OpenMRS. The bahmnicore module exposes a REST endpoint at /openmrs/ws/rest/v1/bahmnicore/sql used to run predefined search queries. The additionalParams function accepts a test argument that is concatenated into a SQL statement without sufficient sanitization. An authenticated attacker can craft a request that appends attacker-controlled SQL syntax to the underlying query. The exploit is publicly disclosed through VulDB entry 377782 and the associated GitHub Security Advisory.

Root Cause

The vulnerability stems from improper neutralization of user-supplied input passed to a downstream SQL execution component. The test parameter reaches the query construction path without parameterized binding or strict input validation. This aligns with the CWE-74 injection category.

Attack Vector

Exploitation requires network access to the Bahmni web application and low-privilege authenticated access. An attacker submits an HTTP request to the vulnerable Search Endpoint with a malicious test argument. The injected SQL executes with the privileges of the Bahmni database user, which typically has read and write access to the clinical schema. Successful exploitation may expose patient records, alter data, or enable further lateral movement inside the healthcare environment. Refer to the Bahmni Security Patch Notes and the GitHub Security Advisory GHSA-cg9w-r5g6-cxq5 for full technical details.

Detection Methods for CVE-2026-15477

Indicators of Compromise

HTTP requests to /openmrs/ws/rest/v1/bahmnicore/sql containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the test parameter.
Application or database logs showing unexpected query structures originating from the additionalParams code path.
Unusual authenticated sessions issuing repeated requests to the Search Endpoint with varying payloads.

Detection Strategies

Enable verbose application logging on the Bahmni REST layer and capture full request bodies for the bahmnicore/sql endpoint.
Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting the test parameter.
Correlate authentication events with anomalous query patterns using a SIEM to surface low-privilege accounts probing the Search Endpoint.

Monitoring Recommendations

Alert on database errors originating from the Bahmni service account, which often indicate probing during injection attempts.
Monitor egress traffic from the Bahmni application server for unexpected data volumes that may signal exfiltration.
Track new or modified rows in sensitive clinical tables outside normal application workflows.

How to Mitigate CVE-2026-15477

Immediate Actions Required

Upgrade bahmnicore to a fixed release: 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, or 2.0.1 depending on the deployed branch.
Rotate credentials for the Bahmni database user and any application accounts if compromise is suspected.
Review access logs for the Search Endpoint since deployment to identify prior exploitation attempts.

Patch Information

The Bahmni project has released patched versions 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, and 2.0.1. Details are documented in the Bahmni Security Patch July 02 2026 Release Notes and GitHub Security Advisory GHSA-cg9w-r5g6-cxq5. Additional metadata is available at the VulDB entry for CVE-2026-15477.

Workarounds

Restrict network access to the /openmrs/ws/rest/v1/bahmnicore/sql endpoint using reverse proxy rules until patching completes.
Apply WAF signatures that block SQL metacharacters in the test parameter of the Search Endpoint.
Reduce the privileges of the Bahmni database account so that injected queries cannot access tables outside the required clinical schema.

bash

# Example nginx snippet restricting the vulnerable endpoint to trusted networks
location /openmrs/ws/rest/v1/bahmnicore/sql {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://bahmni-backend;
}