Cyber ·
CVE-2026-113873 to 113876: HAPI FHIR allows cross-tenant access and heap exhaustion
CISA published four CVE records and advisory VA-26-294-01 on flaws in HAPI FHIR, an open-source Java implementation of the HL7 FHIR standard. In the worst case, a user authorized for one tenant can read or write data in another tenant's partition.
According to the text published on October 22, 2026 by Abhinav Agarwal in the oss-sec feed, four vulnerabilities in HAPI FHIR may allow access to or writing of data in other tenants' partitions, and heap exhaustion. CISA published the CVE records and CSAF advisory VA-26-294-01, and the flaws were coordinated under case VINCE VU#394579. The author reproduced all four flaws on upstream HAPI FHIR 8.10.0, commit 96ac50f89455, using synthetic data. In the worst case, a user authorized for one tenant can read data from another tenant or create data in another tenant's partition. One flaw, related to gzip, causes heap exhaustion.
The source text gives an incomplete list of affected versions, so this piece cannot confirm which builds are exposed. To verify, consult the CSAF advisory and CVE records published by CISA and the coordination case mentioned. The relevance to AI work lies in multitenant FHIR deployments whose clinical or personal extracts are sent to models. Rota Nacional does not patch the HAPI FHIR server and does not resolve these software flaws. Even so, personal data sent through the API passes through the platform barrier, which detects CPF, CNPJ, email, phone numbers and names and applies placeholders, removal or blocking. This protection does not replace applying fixes or correctly isolating tenants.