Live › vulnerability › CVE-2026-113874
Go to dashboardA caller authorized for one tenant can put the request-partition-ids extension on a transaction/batch Bundle entry and override the trusted X-Request-Partition-IDs header, reading from or writing to another tenant's partition. HAPI FHIR ships no entitlement check by default, so it is exploitable unless you register one. No fix exists yet (CISA: all versions affected).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HAPI FHIR | maven | >= 8.2.0 (CISA lists all versions) | – |
8.2.0, where the extension handler first shipped; Smile CDR 2026.05.R01 is based on 8.10.0) with partitioning enabled, RequestHeaderPartitionInterceptor behind an authenticating gateway, and no STORAGE_PARTITION_SELECTED hook that checks the caller's entitlement8.12.1 and Smile CDR notesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
This page as .md · .json · in your agent: get_signal("CVE-2026-113874")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.