Vulnerability · Published Jun 2, 2026 · Assigned by VulnCheck

CVE-2026-49120Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint

High 8.5

In plain English

A high-severity server-side request forgery in medplum from medplum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.

Affected products (as reported)

Vendor	Product	Versions
medplum	medplum	0 – before 5.1.14

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/medplum/medplum/releases/tag/v5.1.14 release-notes
https://github.com/medplum/medplum/pull/9334 issue-tracking
https://github.com/medplum/medplum/commit/87595e98d756d840d70d9dc87beb9d4f9e158b59 patch
https://www.vulncheck.com/advisories/medplum-ssrf-via-fhir-subscription-endpoint third-party-advisory