Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-02 | 1 | Disclosure1 |
| 2026-06-04 | 1 | Disclosure1 |
| 2026-07-25 | 1 | Patch1 |
CVE-2026-49120: Medplum FHIR server let authenticated users create Subscriptions with arbitrary endpoint URLs. The worker made the request. That's SSRF with cloud metadata access. If you run a FHIR stack, here's the Thursday check:
Post summary
Medplum FHIR server allows authenticated users to create subscriptions with arbitrary endpoint URLs, enabling SSRF that can access cloud metadata services.
🚨 HIGH SEVERITY: CVE-2026-49120 (CVSS 8.5) Medplum <5[.]1[.]14 has SSRF vulnerability allowing authenticated users to exfiltrate IAM credentials & patient health records via malicious FHIR Subscription endpoints. Patch immediately! #CVE #Vulnerability #PatchNow https://t.co/9s6eritU7R
Post summary
The tweet alerts users to a high‑severity SSRF flaw in Medplum versions below 5.1.14 that lets authenticated users steal IAM credentials and patient data, and urges an immediate patch.
CVE-2026-49120 Server-Side Request Forgery in Medplum Before 5.1.14 via FHIR Subscriptions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49120
Post summary
The text announces CVE-2026-49120 as a SSRF vulnerability in Medplum versions prior to 5.1.14 that can be triggered via FHIR Subscriptions, directing readers to a vulnerability details page.