CVE-2026-41258 Overview
CVE-2026-41258 is a server-side template injection vulnerability in OpenMRS Core, an open source electronic medical record system platform. The flaw resides in the ConceptReferenceRangeUtility.evaluateCriteria() method, which evaluates database-stored criteria strings as Apache Velocity templates without sandbox configuration. A user with the Manage Concepts privilege can store a malicious Velocity expression in a concept's reference range criteria field. The payload executes automatically whenever a user or API call validates an observation against the affected concept. The vulnerability is classified as Code Injection [CWE-94] and affects OpenMRS versions 2.7.0 through 2.7.8 and 2.8.0 through 2.8.5.
Critical Impact
Authenticated attackers can achieve unrestricted Java reflection and remote code execution on the OpenMRS server through stored Velocity template payloads.
Affected Products
- OpenMRS Core 2.7.0 through 2.7.8
- OpenMRS Core 2.8.0 through 2.8.5
- Electronic medical record deployments using affected OpenMRS Core releases
Discovery Timeline
- 2026-05-15 - CVE-2026-41258 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-41258
Vulnerability Analysis
The ConceptReferenceRangeUtility.evaluateCriteria() method evaluates reference range criteria stored in the OpenMRS database as Apache Velocity templates. The VelocityEngine is initialized with only logging properties and the noSecureUberspector option is not enabled. This leaves the default UberspectImpl in place, which permits unrestricted Java reflection through template expressions.
The Velocity evaluation context exposes three powerful objects to template authors. $patient references the Person or Patient object, $obs references the Obs object under validation, and $fn references the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer. Through Velocity reflection, an attacker can pivot from these references to arbitrary Java class loading and method invocation.
Root Cause
The root cause is missing sandbox configuration on the embedded Velocity engine. OpenMRS instantiates the engine without SecureUberspector, without an introspection allowlist, and without input validation on stored criteria strings. Velocity treats the entire stored string as a trusted template, enabling reflection-based gadget chains.
Attack Vector
An authenticated attacker with the Manage Concepts privilege creates or modifies a concept and inserts a malicious Velocity expression into its reference range criteria field. Subsequent observation validation, whether triggered by clinical users in the web interface or by REST API calls, evaluates the stored expression server-side. The privilege requirement raises the attack complexity but does not prevent abuse by compromised clinical staff accounts or malicious insiders. The Velocity payload uses Java reflection via the exposed context objects to load arbitrary classes and execute operating system commands with the OpenMRS application server's privileges. See the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-41258
Indicators of Compromise
- Concept reference range criteria fields containing Velocity directives such as #set, $class.forName, or references to java.lang.Runtime
- Unexpected child processes spawned by the OpenMRS Java application server
- Outbound network connections from the OpenMRS process to attacker-controlled hosts following observation validation requests
- Audit log entries showing concept modifications by accounts that do not normally manage clinical metadata
Detection Strategies
- Query the OpenMRS database for concept_reference_range rows containing Velocity syntax characters such as #, ${, or getClass(
- Review application logs for Velocity rendering errors or reflection exceptions originating from ConceptReferenceRangeUtility
- Correlate concept edits with the Manage Concepts privilege grants to identify privilege abuse
Monitoring Recommendations
- Forward OpenMRS application and audit logs to a centralized analytics platform for anomaly detection
- Alert on process creation events where the OpenMRS JVM spawns shells, scripting interpreters, or network utilities
- Monitor REST API traffic to /ws/rest/v1/obs endpoints for spikes that may indicate triggered payload execution
How to Mitigate CVE-2026-41258
Immediate Actions Required
- Upgrade OpenMRS Core to version 2.7.9 or 2.8.6, which disable unrestricted reflection in the Velocity engine
- Audit all existing concepts for malicious or unexpected reference range criteria values and remove suspicious entries
- Review and reduce the membership of roles that hold the Manage Concepts privilege
- Rotate credentials and review session tokens for any account suspected of abusing the privilege
Patch Information
The OpenMRS maintainers fixed the issue in OpenMRS Core 2.7.9 and 2.8.6. The patched releases initialize the Velocity engine with SecureUberspector and restrict reflective access through the template context. Refer to the GitHub Security Advisory GHSA-xj4f-8jjg-vx4q for release notes and upgrade guidance.
Workarounds
- Temporarily revoke the Manage Concepts privilege from non-administrative roles until patching is complete
- Disable or block API endpoints that trigger observation validation if upgrade is delayed
- Apply database-level constraints or triggers that reject reference range criteria containing Velocity control characters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
