CVE-2026-47660 Overview
CVE-2026-47660 affects Pathling Server, a toolset that integrates Fast Healthcare Interoperability Resources (FHIR) and clinical terminology into health data analytics workflows. Versions prior to 2.0.0 contain a flaw in the bulk-submit operation. An allowed submitter can supply an explicit oauthMetadataUrl parameter that is not validated against the pathling.bulkSubmit.allowableSources allowlist. The server trusts the metadata and token_endpoint returned from the attacker-chosen location, then sends outbound OAuth client authentication built from the submitter's stored credentials. This exposes stored OAuth client credentials to an unintended endpoint. The issue is fixed in Pathling Server 2.0.0 and is tracked as [CWE-522: Insufficiently Protected Credentials].
Critical Impact
An authenticated submitter can redirect OAuth client authentication to an attacker-controlled token_endpoint, disclosing stored credentials to a third party.
Affected Products
- Pathling Server versions prior to 2.0.0
- Deployments exposing the bulk-submit operation to submitters
- Pipelines relying on pathling.bulkSubmit.allowableSources as a trust boundary
Discovery Timeline
- 2026-08-07 - CVE-2026-47660 published to NVD
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-47660
Vulnerability Analysis
Pathling Server's bulk-submit operation initiates an OAuth 2.0 client-credentials flow to authenticate against a remote FHIR bulk data source. The flow discovers the authorization server through an OAuth metadata document referenced by oauthMetadataUrl. When a submitter supplies this parameter directly in the bulk-submit request, the server fetches the metadata document without verifying that the URL matches an entry in pathling.bulkSubmit.allowableSources. The server then uses the token_endpoint field from the returned metadata as the destination for the outbound token request. Because the server signs and transmits the OAuth client authentication using credentials stored on behalf of the submitter, an attacker who controls the metadata URL receives those credentials at a token endpoint of their choosing. The result is credential disclosure to an unintended party over the network.
Root Cause
The root cause is missing allowlist enforcement on a user-controlled input. The pathling.bulkSubmit.allowableSources configuration is intended to constrain outbound requests to trusted FHIR bulk data servers, but the bulk-submit handler bypasses this check when oauthMetadataUrl is provided explicitly. Trust is anchored in the caller-chosen location rather than in server configuration.
Attack Vector
The attack requires network access to the bulk-submit endpoint and an account authorized to submit jobs. The attacker hosts an OAuth metadata document that advertises an attacker-controlled token_endpoint. They then invoke bulk-submit with oauthMetadataUrl pointing at that document. The Pathling Server fetches the metadata, builds an OAuth client-credentials request using the submitter's stored client ID and secret, and transmits it to the attacker's endpoint. The attacker captures the credentials for later reuse against legitimate authorization servers.
See the GitHub Security Advisory GHSA-245h-c573-9vr5 for full technical details.
Detection Methods for CVE-2026-47660
Indicators of Compromise
- Bulk-submit requests containing an oauthMetadataUrl parameter pointing to a host not listed in pathling.bulkSubmit.allowableSources.
- Outbound HTTPS connections from the Pathling Server to unfamiliar token_endpoint hosts following bulk-submit invocations.
- OAuth metadata documents fetched from domains that do not match configured FHIR bulk data providers.
Detection Strategies
- Review Pathling Server request logs for bulk-submit calls that include an explicit oauthMetadataUrl and compare each value against the configured allowlist.
- Correlate submitter identity, oauthMetadataUrl values, and outbound token_endpoint destinations to spot mismatches.
- Alert when the server issues client-credentials token requests to hosts outside a known-good list of authorization servers.
Monitoring Recommendations
- Forward Pathling application logs and outbound proxy logs to a central analytics platform for retention and correlation.
- Baseline the set of token_endpoint destinations contacted by the server and alert on new domains.
- Monitor for reuse of Pathling-managed OAuth client IDs from source IPs that do not belong to the Pathling deployment.
How to Mitigate CVE-2026-47660
Immediate Actions Required
- Upgrade Pathling Server to version 2.0.0 or later.
- Rotate every OAuth client secret configured for bulk-submit sources, since prior use of the vulnerable endpoint may have exposed them.
- Audit historical bulk-submit requests for any oauthMetadataUrl values that fall outside the configured allowlist.
- Restrict submitter accounts to trusted users and enforce least privilege on the bulk-submit operation.
Patch Information
Pathling Server 2.0.0 enforces validation of oauthMetadataUrl against pathling.bulkSubmit.allowableSources and removes the trust placed in caller-supplied metadata locations. Apply the upgrade per the Pathling security advisory.
Workarounds
- If upgrading immediately is not feasible, disable the bulk-submit operation until the patch is applied.
- Block outbound network egress from the Pathling Server to any host not on an approved allowlist of FHIR authorization servers.
- Remove or scope down stored OAuth client credentials so that a leaked secret has minimal privileges at the legitimate authorization server.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
