CVE-2026-33180: 
Java vulnerability analysis and mitigation

CVE-2026-33180 is an HTTP authentication leak vulnerability in HAPI FHIR (a Java implementation of the HL7 FHIR healthcare interoperability standard) where the internal HTTP client forwards sensitive request headers to redirect destinations without stripping them. When the client follows a 30X redirect, it resends the original headers — including authentication tokens and API keys — to the host specified in the Location response header, potentially exposing credentials to unintended parties. The vulnerability affects all ca.uhn.hapi.fhir Maven packages (including org.hl7.fhir.utilities, org.hl7.fhir.validation, org.hl7.fhir.r4, org.hl7.fhir.r5, and others) prior to version 6.8.3/6.9.0. It was published on March 17, 2026, and assigned a CVSS v3.1 score of 9.8 (Critical) by the GitHub Advisory Database, though NVD rates it 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-201 (Insertion of Sensitive Information Into Sent Data). The HAPI FHIR internal HTTP client does not strip or filter request headers when following HTTP redirects to a different host; instead, it blindly forwards the full original header set — including Authorization, API keys, and session tokens — to the redirect target specified in the Location header. Exploitation requires no authentication or special privileges and is network-accessible, making it trivially exploitable if an attacker can control or influence a redirect destination (e.g., via a man-in-the-middle position or a compromised upstream server). No public proof-of-concept code has been identified (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to capture sensitive HTTP headers — including authentication tokens, API keys, and session credentials — that are forwarded to an attacker-controlled redirect destination. In healthcare environments where HAPI FHIR is commonly deployed, this could expose protected health information (PHI) access credentials, enabling unauthorized access to FHIR servers and patient data. The vulnerability also enables client impersonation, where an attacker reuses captured credentials to make authenticated requests on behalf of the victim system, potentially leading to data exfiltration or unauthorized modification of healthcare records (GitHub Advisory, Red Hat Bugzilla).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.031–0.046%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat Bugzilla).

1. Identify a target: Locate a system using a vulnerable HAPI FHIR library (any ca.uhn.hapi.fhir Maven package prior to version 6.8.3) that makes outbound HTTP requests with authentication headers (e.g., Authorization: Bearer <token>).
2. Position for redirect control: Gain the ability to serve a 30X HTTP redirect response to the HAPI FHIR client — this could be achieved via a compromised upstream FHIR server, a DNS hijack, or a man-in-the-middle network position.
3. Serve a malicious redirect: When the HAPI FHIR client makes a request to the legitimate server, respond with a 301/302 redirect pointing the Location header to an attacker-controlled server (e.g., Location: https://attacker.example.com/capture).
4. Capture forwarded headers: The vulnerable HAPI FHIR HTTP client follows the redirect and resends the original request headers — including Authorization tokens and API keys — to the attacker-controlled server.
5. Exploit captured credentials: Use the captured authentication headers to impersonate the HAPI FHIR client, making authenticated requests to the original FHIR server to access or manipulate healthcare data (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from HAPI FHIR application servers to unfamiliar or external hosts, particularly following a redirect chain; HTTP requests to external IPs carrying Authorization headers.
• Logs: Application logs showing HTTP 30X redirect responses from FHIR endpoints followed by requests to unexpected destination hosts; access logs on attacker-controlled servers showing inbound requests with Authorization or API key headers originating from HAPI FHIR client IPs.
• Application Behavior: Unusual authentication failures or token reuse alerts on FHIR servers, potentially indicating captured credentials being replayed; unexpected API calls using valid tokens from unfamiliar source IPs.

Upgrade all affected ca.uhn.hapi.fhir Maven packages to version 6.8.3 or later (the original advisory patch version), or to 6.9.0 as referenced by the NVD and Red Hat. The vendor has confirmed no workarounds are available for unpatched versions. As a defense-in-depth measure, configure network egress controls to restrict HAPI FHIR servers from making outbound connections to untrusted external hosts, and consider disabling automatic redirect following in HTTP client configurations where possible (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system and assigned it high priority and severity, indicating concern for downstream products that may depend on HAPI FHIR (Red Hat Bugzilla). The vulnerability was noted on Mastodon by security community accounts shortly after disclosure. Given HAPI FHIR's widespread use in healthcare interoperability systems, the vulnerability has drawn attention from the health IT security community due to the sensitivity of the data these systems handle.