CVE-2026-45574 Overview
CVE-2026-45574 is a TLS certificate validation flaw in epa4all-client, the Java client for epa4all / ePA 3.0 used in the German Telematik Infrastruktur. Versions prior to 1.2.2 fail to properly validate TLS certificates presented by the ePA service. An attacker positioned on the network path between the ePA service and the Konnektor can present any TLS certificate, including self-signed, expired, or wrong-CN certificates, and intercept SOAP traffic. Intercepted data includes patient identifiers (KVNR), SMC-B card operations such as authentication and signing, document content, and credential exchanges. The issue is tracked under [CWE-295] Improper Certificate Validation and is fixed in version 1.2.2.
Critical Impact
An adjacent-network attacker can perform man-in-the-middle interception of healthcare SOAP traffic, exposing patient identifiers, signing operations, and credentials.
Affected Products
- epa4all-client versions prior to 1.2.2
- Java integrations consuming the epa4all / ePA 3.0 client library
- Telematik Infrastruktur Konnektor deployments using the affected client
Discovery Timeline
- 2026-05-26 - CVE-2026-45574 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45574
Vulnerability Analysis
The vulnerability resides in the TLS connection logic of epa4all-client. The client establishes HTTPS connections to the ePA service without enforcing proper certificate trust chain or hostname verification. As a result, the client accepts any certificate presented by the remote endpoint, including untrusted, expired, or mismatched certificates.
This behavior breaks the confidentiality and integrity guarantees TLS is intended to provide. SOAP messages exchanged between the Konnektor and the ePA service carry highly sensitive payloads, including KVNR patient identifiers, SMC-B smartcard authentication and signing requests, electronic health record document content, and credential material.
The vulnerability is classified under [CWE-295] Improper Certificate Validation. Exploitation requires the attacker to reside on the network path, which limits the attack surface to adjacent network positions such as compromised routers, ARP-spoofed segments, or rogue infrastructure within the Telematik network.
Root Cause
The root cause is the absence or misconfiguration of certificate validation in the HTTPS client used by epa4all-client. The TLS stack does not verify the certificate chain against a trusted certificate authority and does not validate that the certificate Common Name or Subject Alternative Name matches the expected ePA service hostname.
Attack Vector
An attacker with a network-adjacent position intercepts the TCP connection between the Konnektor and the ePA service. The attacker terminates the TLS session using an arbitrary certificate, re-establishes a separate TLS session to the legitimate ePA service, and relays SOAP requests and responses between both sessions. Because the client accepts the attacker's certificate, the Konnektor is unaware of the interception. The attacker reads and modifies all transiting healthcare data in cleartext at the proxy point.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-5hhf-xmfx-4vvr and the GitHub Pull Request Update for the technical fix.
Detection Methods for CVE-2026-45574
Indicators of Compromise
- Unexpected TLS certificates presented to Konnektor systems that do not chain to the Telematik Infrastruktur trust anchors.
- Outbound TLS sessions from epa4all-client hosts to IP addresses outside the published ePA service ranges.
- ARP table anomalies or duplicate MAC entries on network segments hosting Konnektor traffic.
Detection Strategies
- Inspect TLS handshakes from Konnektor hosts and alert when the server certificate is self-signed, expired, or has a Common Name not matching the expected ePA service endpoint.
- Compare deployed epa4all-client library versions against 1.2.2 across software inventories and flag older builds.
- Correlate SOAP transaction volumes with baseline ePA service traffic patterns to identify proxied or duplicated sessions.
Monitoring Recommendations
- Enable continuous monitoring of TLS metadata, including issuer, validity, and SAN fields, for all Konnektor egress traffic.
- Log and review certificate pinning failures and unexpected trust store modifications on Konnektor hosts.
- Alert on new ARP, DHCP, or routing changes within network segments carrying Telematik Infrastruktur traffic.
How to Mitigate CVE-2026-45574
Immediate Actions Required
- Upgrade epa4all-client to version 1.2.2 or later across all Konnektor and integration hosts.
- Audit network paths between Konnektors and the ePA service for unauthorized devices or proxies.
- Rotate any SMC-B credentials and review signing operation logs for activity that predates the upgrade.
Patch Information
The maintainers fixed the certificate validation logic in epa4all-client version 1.2.2. The fix enforces standard TLS trust chain and hostname verification. Details are available in the GitHub Pull Request Update and the GitHub Security Advisory GHSA-5hhf-xmfx-4vvr.
Workarounds
- Restrict outbound connectivity from Konnektor hosts to only the published ePA service IP ranges using firewall allowlists.
- Deploy network segmentation to prevent unauthorized devices from reaching the Konnektor-to-ePA path.
- Where feasible, enforce certificate pinning at a TLS-terminating proxy until the client upgrade is completed.
# Configuration example: Maven dependency update to the fixed version
# pom.xml
# <dependency>
# <groupId>com.oviva.epa4all</groupId>
# <artifactId>epa4all-client</artifactId>
# <version>1.2.2</version>
# </dependency>
mvn versions:set-property -Dproperty=epa4all-client.version -DnewVersion=1.2.2
mvn clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
