Bahmni bahmni-core: SQL injection enabling patient data exfiltration

Summary

Bahmni bahmni-core, the OpenMRS core modules used by the Bahmni clinical information system, contains an SQL injection flaw in version 0.93. An attacker with a valid user account and network access can use boolean-blind and error-based techniques to read sensitive patient data from the database. No data is returned directly, so the attacker must infer it step by step.

Affected

• bahmni-core (Maven: org.bahmni.module.bahmnicore-omod) version 0.93
• The GHSA advisory lists affected versions as >= 0.93. Whether later branches are affected is unknown.

Fixed in

• Version 0.93.1 (per the CVE record and the vendor's Bahmni Security Patch release of 2 July 2026)
• The advisory also lists patched versions 1.0.1, 1.1.1, 1.2.1, 1.3.1 and 2.0.1 for the other branches.

Workaround

• If the "High Risk Patients" search query is not used, remove the global property "emrapi.sqlSearch.highRiskPatients".
• Restrict access to trusted IP addresses if only specific users within a network need the system.
• Review and restrict access to the SQL search to essential personnel only.
• Monitor system and application logs for unusual data-access activity.

Exploitation

• Not known to be exploited in the wild.
• Not listed in CISA KEV.
• Public proof-of-concept: one source reports none; the data is inconsistent, so confidence is low.
• Related CVE-2026-15477 points to the same advisory and an OSV entry reports a public exploit. It is unclear whether both CVEs describe the same flaw.

Our recommendation

• Check whether any Bahmni or OpenMRS instance runs bahmni-core 0.93 and upgrade to 0.93.1 or a later patched version.
• Check for CVE-2026-15477 at the same time.
• Until patched, restrict access to the Bahmni/OpenMRS endpoints to the clinic network and reduce accounts that can reach them.
• Limit the database account's privileges and review access logs for requests to the bahmnicore search endpoints.
• Priority is high if the system is internet-exposed and moderate otherwise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-cg9w-r5g6-cxq5 github.com
• CVE Record CVE-2026-63192 www.cve.org
• Bahmni Security Patch July 02 2026 Release Notes bahmni.atlassian.net
• Strix CVE-2026-63192 www.strix.ai
• OSV CVE-2026-15477 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:01.