CVE-2026-49120: Medplum SSRF Vulnerability

CVE-2026-49120 Overview

CVE-2026-49120 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Medplum versions prior to 5.1.14. The flaw exists in the subscription worker, which dispatches outbound HTTP requests for FHIR Subscription resources. Authenticated users can register a Subscription with an arbitrary endpoint URL, causing the server to issue requests to internal network destinations. Attackers can target cloud instance metadata services, internal databases, or container orchestration APIs. The Subscription worker transmits full FHIR resource payloads in the POST body, enabling exfiltration of IAM credentials and patient health records to attacker-controlled or internal endpoints.

Critical Impact
Authenticated attackers can coerce the Medplum server into issuing internal HTTP requests, exposing cloud metadata credentials and protected health information (PHI) through subscription POST bodies.

Affected Products

Medplum versions before 5.1.14
Medplum server subscription worker component
Deployments processing FHIR Subscription resources with rest-hook channels

Discovery Timeline

2026-06-02 - CVE-2026-49120 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49120

Vulnerability Analysis

Medplum is an open-source healthcare developer platform that implements the Fast Healthcare Interoperability Resources (FHIR) standard. The FHIR Subscription resource allows clients to register webhook endpoints that receive notifications when matching resources change. The subscription worker fetches the configured endpoint URL and sends an HTTP POST containing the triggering FHIR resource payload.

Prior to version 5.1.14, the worker did not validate or restrict the destination URL. Any authenticated user with permission to create Subscriptions could specify an endpoint pointing to an internal address. Cloud metadata services such as http://169.254.169.254/ return short-lived IAM credentials when reachable. Kubernetes API servers and internal databases may respond to crafted requests and surface sensitive responses or accept inbound data carried in the POST body.

Root Cause

The subscription worker accepted arbitrary rest-hook channel endpoint URLs without enforcing an allowlist, blocking private IP ranges, or requiring HTTPS. Insufficient URL validation combined with the worker running inside the trusted network boundary produced the SSRF condition tracked under [CWE-918].

Attack Vector

An authenticated user creates a FHIR Subscription resource whose channel.endpoint references an internal address. When a matching resource event fires, the Medplum server-side worker issues a POST to that internal address. The request body contains the full FHIR resource, so PHI is delivered to the attacker-specified target. Pointing the endpoint at cloud metadata services causes the server to issue requests within the trust boundary of the host instance.

typescript

// Security patch in packages/server/src/config/types.ts
   * Optional flag to require email verification before allowing users to create projects.
   */
  requireVerifiedEmailForProjectCreation?: boolean;
+
+  /** Optional flag to allow rest-hook Subscriptions to send requests to insecure HTTP URLs. */
+  allowInsecureRestHookUrl?: boolean;
}

export interface SubscriptionAutoDisableTrigger {

Source: Medplum commit 87595e9

typescript

// Security patch in packages/server/src/config/utils.ts
const booleanKeys = new Set([
+  'allowInsecureRestHookUrl',
  'botCustomFunctionsEnabled',
  'database.ssl.rejectUnauthorized',
  'database.ssl.require',

Source: Medplum commit 87595e9

The patch introduces the allowInsecureRestHookUrl configuration flag, requiring HTTPS for rest-hook Subscription URLs by default and forcing explicit opt-in for plaintext HTTP destinations.

Detection Methods for CVE-2026-49120

Indicators of Compromise

FHIR Subscription resources where channel.endpoint references private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses, or link-local 169.254.169.254.
Outbound HTTP requests from Medplum subscription workers to non-public destinations or to cloud metadata service IPs.
Subscription endpoints using http:// instead of https:// schemes after upgrading past 5.1.14.
Unexpected creation of Subscription resources by low-privilege user accounts.

Detection Strategies

Audit the Medplum database for existing Subscription resources and review every channel.endpoint value for internal or metadata addresses.
Inspect application logs from the subscription worker for delivery attempts to non-routable or private IP destinations.
Correlate Subscription creation events with the authenticated user identity to detect anomalous configuration by accounts that do not typically integrate webhooks.

Monitoring Recommendations

Forward Medplum server logs and egress proxy logs to a centralized analytics platform and alert on outbound traffic from the subscription worker to RFC1918 ranges or 169.254.169.254.
Monitor cloud audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit) for unexpected use of IAM credentials sourced from the host instance role.
Track creation, update, and deletion events for FHIR Subscription resources and review changes to channel.endpoint fields.

How to Mitigate CVE-2026-49120

Immediate Actions Required

Upgrade Medplum to version 5.1.14 or later, which enforces HTTPS for rest-hook Subscription URLs by default.
Review and remove any existing Subscription resources whose endpoints reference internal, loopback, or cloud metadata addresses.
Rotate IAM credentials, API tokens, and database secrets reachable from the Medplum server host if SSRF activity is suspected.
Restrict Subscription creation permissions to trusted project roles where feasible.

Patch Information

The fix is included in Medplum release v5.1.14 via pull request #9334 and commit 87595e9. Additional context is available in the VulnCheck SSRF Advisory.

Workarounds

Deploy the Medplum subscription worker behind an egress proxy or firewall that denies outbound traffic to RFC1918 ranges, loopback addresses, and 169.254.169.254.
Enforce IMDSv2 on AWS EC2 instances hosting Medplum so that metadata access requires a session token unavailable via SSRF.
Leave allowInsecureRestHookUrl unset (default false) after upgrading so the worker rejects plaintext HTTP destinations.
Apply network segmentation that isolates the Medplum server from internal databases and orchestration APIs not required for normal operation.

bash

# Configuration example: enforce HTTPS-only rest-hook subscriptions (default after 5.1.14)
# medplum.config.json
{
  "allowInsecureRestHookUrl": false
}