CVE-2026-22742 - Vulnerability Analysis

Overview

Spring AI spring-ai-bedrock-converse from 1.0.0 before 1.0.5 and from 1.1.0 before 1.1.4 contains a server-side request forgery caused by insufficient validation of user-supplied media URLs in BedrockProxyChatModel, letting attackers induce the server to make HTTP requests to unintended destinations, exploit requires crafted multimodal messages with media URLs.

Severity & Score

Impact

Attackers can make the server send HTTP requests to internal or external unintended destinations, potentially accessing sensitive internal resources or causing other impacts.

Mitigation

Upgrade to versions 1.0.5, 1.1.4 or later.

References

• https://spring.io/security/cve-2026-22742

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 28, 2026

🟠 CVE-2026-22742 - High (8.6) Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22742/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner