# Get a free FHIR vulnerability scan before the 2027 CMS deadline
Author: Cantina
Published: September 1, 2027
Topics: FHIR, healthcare security, FHIR API security, CMS-0057-F, authorization, OAuth security
Canonical URL: https://www.cantina.security/blog/fhir-api-security-2027-cms-deadline

January 1, 2027 sounds a long way off. For the teams covered by [CMS-0057-F](https://www.cms.gov/initiatives/burden-reduction/overview/interoperability/policies-regulations/cms-interoperability-prior-authorization-final-rule-cms-0057-f), it is not. By then, certain payers need to have new or updated [FHIR](https://isp.healthit.gov/fhir-ecosystem-0) (Fast Healthcare Interoperability Resources) capabilities in place for patient access, provider access, payer-to-payer exchange, and prior authorization.

A lot has to work for those connections to be useful. The API has to speak FHIR correctly, of course. But conformance is only one test. It will not tell you whether a token carries too much authority, one tenant can reach another tenant's records, or an outbound request can be redirected somewhere it should never go. FHIR compliance gets you connected. Cantina makes sure the connection is safe.

Pathling made this real for us. Apex reviewed the open-source FHIR analytics server and found five high-severity issues, which led to six public advisories. The trouble was not malformed FHIR. It sat around the edges of the implementation, where credentials, access controls, external requests, and patient data met.

The findings included missing authorization checks that let narrowly scoped OAuth tokens reach other FHIR resource types (CWE-862), server-side request forgery that could send bearer tokens or OAuth client credentials to an attacker-controlled server (CWE-918 and CWE-522), and path traversal in asynchronous export endpoints that could expose warehouse files containing patient records (CWE-22). You can read the technical breakdowns in [TrustLaunder](https://www.cantina.security/blog/pathling-cve-2026-47664) and [Apex's other Pathling findings](https://www.cantina.security/blog/pathling-phi-exposure-4-more-from-apex).

That is an uncomfortable lesson for anyone putting FHIR into production, whether or not CMS-0057-F applies to them. An API can follow the standard and still make a dangerous authorization decision.

## How the scan works

The scan will be run by [Apex](https://www.cantina.security/apex), Cantina’s autonomous OffSec agent. Apex analyzes your environment in context, including its code and connected systems, to understand how it works and where an attacker could influence its behavior.

Then, it follows potential attack paths, tests whether suspected issues are reachable, and reproduces their impact. Each validated finding includes supporting evidence and clear remediation guidance. As mentioned above, Apex used this process to find 5 high-severity vulnerabilities in Pathling. Based on your approval policy, Apex can also generate a fix and retest the change to verify that the issue has been closed.

For example, Apex may examine authentication and authorization, patient and tenant isolation, resource-level permissions, token handling, prior authorization integrity, bulk exports, identity providers, data stores, device identity, data provenance, or the services connected to the API. When it’s done, you receive an executive risk summary, the technical findings, and a remediation plan. Our team helps your team work through the findings and can retest the fixes against the same request paths when they are ready.

If the initial scan uncovers a need for deeper security measures, that work can be scoped separately.

## Is this for you?

**All healthcare providers working with FHIR are eligible to apply.**

Whether they are directly covered by CMS-0057-F or not. The program is also open to payers and health plans, EHR and health technology companies, health information networks and data infrastructure providers, patient-facing and AI health products, and device, remote patient monitoring, wearable, and clinical telemetry teams.

If you build, expose, integrate, or consume FHIR and health-data APIs, tell us what you are launching, changing, or already running. Start with the workflow closest to launch.

[Claim your free vulnerability scan here.](https://www.cantina.security/fhir-readiness)