Security1 publisher2 min readPublished
Authenticated SQL in Mirth Connect hands over the credentials for the systems it connects to
Three flaws in NextGen Healthcare Mirth Connect 4.7.1 and earlier share a single fix in version 4.7.2. The one that changes blast radius lets an authenticated user read the engine's stored credentials for connected systems.
The Watch · Security desk
What happened
- CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578 are listed together against the same affected range, with no statement of which CVE belongs to which of the three described weaknesses.
- NextGen tells users to update to Mirth Connect 4.7.2 or later, available from its customer portal, and lists that same fix against each of the three vulnerabilities.
- Abhinav Agarwal reported the vulnerabilities to CISA, which files the advisory under healthcare and public health with deployment recorded as worldwide.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure One Mirth account turns into reach across whatever the engine was integrated with, because the asset an attacker takes is the credential store rather than the message traffic moving through the channels.
- constraint Keeping the engine off the internet and behind firewalls narrows who can call the API, but an attacker who already holds an account keeps the same SQL path, so segmentation buys time rather than closing the hole.
- decision With one point release covering all three findings, the only thing left for asset owners to argue about is the maintenance window on a system that sits in the middle of clinical interfaces.
- contradiction The summary caps impact at data exfiltration and denial of service, while the vulnerability text also grants arbitrary file write, which is a foothold on the host and reads as a higher-severity primitive than a leak.
The Database Connector is how a Mirth channel reaches a database at either end of an interface. CISA's advisory says arbitrary SQL through its API can disclose the credentials the engine stores for connected systems, write arbitrary files, and cause a denial of service [2]. Credential disclosure is the part that changes ownership: an account on the integration engine converts into accounts on whatever the engine was wired into.
The advisory does not name the connected systems, does not say whether the stored credentials are protected at rest, and does not say what privilege an account needs before it can call the Database Connector API [18]. That gap bounds how far the conversion goes. What the advisory does establish is that the credential store is reachable from an authenticated session, which is a different problem from reading messages out of a channel.
No CVSS values are recorded under the advisory's Metrics headings [10], and there is no statement that any of this has been exploited or attribution to any actor [11]. That leaves exploitability to be judged on structure. The SQL path needs an account and nothing else [2]. The two XML external entity paths are conditional: one lives in the XSLT Transformer Step, which builds a bare TransformerFactory [4], and the other only opens when XML batch processing is enabled and the XPath option is selected [5]. Configuration decides whether those two apply to you. Authentication decides whether the first one does.
Three vulnerabilities, two weakness classes: one SQL injection under CWE-89 and two XXE issues under CWE-611 [13]. All three carry the same affected range and the same remedy, 4.7.2 or later from the NextGen customer portal [6][14]. Nothing needs sequencing.
The real number here is the deferral cost. Anyone who cannot take the engine down this week is running on the assumption that every account on that engine is trustworthy [2]. If that assumption breaks before the upgrade lands, the cleanup goes well past the patch: it means rotating every credential the engine holds for every downstream system, on systems that were never the ones running the vulnerable code [2][6].
What to watch
- Whether CISA later records observed exploitation of any of the three CVEs or adds one to the Known Exploited Vulnerabilities catalog.