Bahmni Security Patch July 02, 2026 Release Notes

Release Date: Jul 2, 2026

Overview

This is a security patch release that includes updates to address known security vulnerabilities in Bahmni Core.

We recommend that all users upgrade to this release at the earliest opportunity.

What's Included

Security Updates

Updated Bahmni OpenMRS Distro and related modules to patched versions addressing disclosed security vulnerabilities.
Updated Bahmni Docker images with the latest security fixes.

Security Advisory

This release resolves the following security vulnerabilities affecting the earlier releases.

Advisory	CVE	Severity	Status

Advisory	CVE	Severity	Status
https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5	CVE-2026-63192	High	Fixed
https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592	CVE-2026-63194	High	Fixed

Component Versions

Patched Library : bahmni-core

Patched Versions: 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, 2.0.1

Docker Distribution

The following Docker-based distributions include patched Bahmni Docker and Bahmni OpenMRS image versions.

Bahmni Lite

Component	Previous Version	Updated Version

Component	Previous Version	Updated Version
Bahmni Docker	1.0.1-lite	1.0.2-lite
Bahmni OpenMRS Image	1.0.1	1.0.2
bahmni-core	1.1.0	1.1.1

Bahmni Standard

Component	Previous Version	Updated Version

Component	Previous Version	Updated Version
Bahmni Docker	1.0.1-standard	1.0.2-standard
Bahmni OpenMRS Image	1.1.2	1.1.3
bahmni-core	1.2.0	1.2.1

Legacy Distribution

Bahmni Deployments 0.93

The patched bahmni-core OMOD 0.93.1 is available for download.
Step 1: Download the JAR file of the library from here. Link to 0.93.1 JAR.

Step 2: Rename the JAR as .omod file

Step 3: Have a backup of the exisiting OMOD in your installation.

Step 4: Replace the existing core OMOD with the renamed one

Step 5: Restart the OpenMRS service.

Upgrade Notes

Upgrade is recommended for all production deployments.
No database migration is required.
Existing configuration remains compatible.
Restart all Bahmni services after the upgrade.

Docker Upgrade

For Docker-based deployments, upgrade to the patched release by pulling the patched images for your distribution and restarting the services. This ensures that the Bahmni OpenMRS image and related Docker images are updated to the fixed versions listed under Docker Distribution.

git clone https://github.com/Bahmni/bahmni-docker.git
cd bahmni-docker

#For Bahmni Lite
git checkout tags/1.0.2-lite
cd bahmni-lite
docker compose --profile bahmni-lite up -d

#For Bahmni Standard
git checkout tags/1.0.2-standard
cd bahmni-standard
docker compose --profile bahmni-standard up -d

./run-bahmni.sh .env

If your deployment pins image versions in the .env file, update the Bahmni Docker and Bahmni OpenMRS image tags to the patched versions for your distribution before running the upgrade commands.

Update the .env file in your implementation directory:

For Bahmni Standard
OPENMRS_IMAGE_TAG=1.1.3

For Bahmni Lite
OPENMRS_IMAGE_TAG=1.0.2

Run the following command to fetch the updated Docker images:

docker compose pull
docker compose up -d

docker compose --env-file .env up -d openmrs

Compatibility

This release is compatible with:

Existing Bahmni configuration
Existing database schema
Supported database versions
Existing OpenMRS modules listed above

No functional changes are expected beyond the included security fixes.

Known Issues

None.

Acknowledgments

We thank Ray Sabee, Whitehat Security , (GitHub: raysabee) who first alerted us to these vulnerabilities and worked with us on a co-ordinated disclosure process and to the Bahmni core team for the prompt patch and release.