Who is this article for?

On-premise customers who are preparing to upgrade to v25.4.

System administrator permissions required.

Release 25.4.0 introduces network-level validation for external data source connection strings as part of our ongoing security hardening programme. This protects against server-side request forgery (SSRF) attacks by blocking connections to certain network address ranges before they are established.

This change affects how Ideagen Healthcare Guardian connects to external databases (SQL Server, Oracle, ODBC) and also applies to model registration. It takes effect when you upgrade to 25.4.0.

Most customers will not need to take any action. However, on-premise customers whose database is on the same server or local network will need to make a small change before upgrading. This change is safe to make at any time in advance and will not affect your current system.

This change only affects on-premise customers.

You are likely affected if your Ideagen Healthcare Guardian application connects to a database on the same server (localhost), over a private network, or via a private IP address. This covers most standard single-server and LAN deployments.

If you are unsure whether you are affected, check your external data source connection strings in Ideagen Healthcare Guardian before your upgrade.

Review how your Ideagen Healthcare Guardian application connects to your database. If it connects to:

• The same server (localhost or 127.0.0.1)

• A private LAN IP address (in the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges)

then you will need to complete step 2 before upgrading.

Open your PPlus.config or web.config file and add the following setting:

Alternatively, set the following environment variable:

This restores access for loopback and private LAN addresses and covers the majority of on-premise deployments. This change can be made at any time before your upgrade and will not affect your current system.

If you prefer a narrower configuration rather than allowing all private network connections, you can specify individual address ranges instead:

Replace 10.10.0.0/16 with the specific subnet your database resides on.

Even with AllowPrivateNetworkConnections enabled, the following ranges remain permanently blocked and cannot be overridden:

• Link-local addresses (169.254.0.0/16)

• Cloud metadata endpoints (e.g. 169.254.169.254)

• CGNAT (100.64.0.0/10)

• Multicast and reserved ranges

These restrictions are intentional security controls and do not affect standard database connectivity.

Once your configuration change is in place, request the release upgrader through your account manager as normal. If you experience any issues or are unsure whether this affects you, please don't hesitate to contact us.

Further reading:

Ideagen Healthcare Guardian v25.4 release notes