CVE-2026-47660: falha de alta gravidade em aehrc pathling
Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
aehrc · pathlingCVEs relacionadas — aehrc pathling
No mesmo produto, das mais perigosas para as menos.
CVE-2026-47661HIGHPathling has path traversal in $result endpoint that allows arbitrary warehouse file readEPSS 0.6%CVE-2026-47659HIGHPathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}EPSS 0.6%CVE-2026-47663HIGHPathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutationEPSS 0.4%CVE-2026-47662HIGHPathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLsEPSS 0.4%CVE-2026-47664HIGHPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningEPSS 0.2%