Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized in…

Medplum versions before 5.1.14 contain a server-side request forgery (SSRF) vulnerability in the subscription worker component. Authenticated users can exploit this by creating FHIR Subscription resources with malicious endpoint URLs pointing to internal network resources. The vulnerability allows attackers to target cloud metadata services, internal databases, and container orchestration endpoints. Successful exploitation can lead to exfiltration of IAM credentials and patient health records through POST requests containing full FHIR resource payloads. This affects healthcare applications using Medplum for FHIR-based health information exchange.