CVE-2026-47660 in Pathling
Summary
by MITRE • 08/07/2026
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects Pathling Server versions prior to 2.0.0, specifically within its bulk-submit operation functionality that handles FHIR and clinical terminology data processing. This represents a critical security flaw that undermines the authentication and authorization mechanisms designed to protect healthcare data analytics workflows. The issue stems from insufficient validation of the `oauthMetadataUrl` parameter, which creates an attack vector allowing malicious actors to manipulate the OAuth flow process.
The technical flaw manifests when an allowed submitter provides an explicit `oauthMetadataUrl` parameter during bulk-submit operations. This parameter bypasses the intended validation mechanism that should restrict metadata sources to those defined in `pathling.bulkSubmit.allowableSources`. The system trust model becomes compromised because it accepts metadata from any caller-chosen location without verification against predefined safe sources. When this occurs, the OAuth flow retrieves metadata and token endpoint information directly from the attacker-controlled URL, enabling potential man-in-the-middle attacks or unauthorized access to healthcare data systems.
This vulnerability creates significant operational impact within healthcare environments where FHIR data analytics are critical for clinical decision-making and patient care coordination. The flaw allows attackers to potentially impersonate legitimate users or gain unauthorized access to sensitive health information through manipulated OAuth flows. The attack surface expands because the system builds outbound OAuth client authentication directly from submitter credentials, meaning that successful exploitation could lead to full access to protected healthcare data repositories. This poses serious risks to patient privacy and compliance with healthcare regulations such as HIPAA.
The vulnerability aligns with CWE-20, "Improper Input Validation," and represents a classic case of insecure direct object reference where external inputs are not properly validated before being used in critical security operations. From an ATT&CK perspective, this weakness maps to T1566.001 "Phishing: Spearphishing Attachment" and T1078 "Valid Accounts" as it could enable attackers to leverage valid submitter credentials through manipulated OAuth flows. Organizations using Pathling Server versions prior to 2.0.0 should immediately implement mitigations including updating to the patched version, reviewing and strengthening the `pathling.bulkSubmit.allowableSources` configuration, implementing additional input validation measures, and monitoring for suspicious bulk-submit activities. Network segmentation and enhanced logging of authentication flows can also help detect potential exploitation attempts. The fix in Pathling Server 2.0.0 addresses this by properly validating the OAuth metadata URL against the allowable sources configuration, ensuring that only pre-approved endpoints can be used during the authentication process and maintaining the integrity of the OAuth flow for healthcare data analytics systems.