CVE-2026-22742: 
Java vulnerability analysis and mitigation

CVE-2026-22742 is a Server-Side Request Forgery (SSRF) vulnerability in Spring AI's spring-ai-bedrock-converse module, specifically within the BedrockProxyChatModel component. When processing multimodal messages containing user-supplied media URLs, insufficient URL validation allows an unauthenticated attacker to induce the server to issue HTTP requests to arbitrary internal or external destinations. The vulnerability affects Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3, and was publicly disclosed on March 26–27, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (Spring Advisory, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from the failure to validate or sanitize user-supplied media URLs before the BedrockProxyChatModel fetches them server-side during multimodal message processing. An attacker can craft a multimodal message payload containing a malicious URL pointing to internal network resources (e.g., cloud metadata endpoints, internal APIs) or external attacker-controlled servers, and submit it over the network without authentication or user interaction. Because the scope is changed (S:C in CVSS), the impact extends beyond the vulnerable component itself to other internal systems reachable by the server. The vulnerability was responsibly reported by researcher Hyunwoo Kim (@V4bel) (Spring Advisory).

Successful exploitation allows an unauthenticated, network-based attacker to leverage the vulnerable server as a proxy to reach internal resources that would otherwise be inaccessible, including cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other services on the same network segment. The primary impact is high confidentiality loss — sensitive data such as credentials, tokens, and internal service responses can be exfiltrated — while integrity and availability are not directly affected. This SSRF can also facilitate internal network reconnaissance, enabling further lateral movement or privilege escalation within cloud-hosted environments (Spring Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit if a PoC were to emerge. The EPSS score is approximately 0.031% (0.000310), indicating a currently low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Reconnaissance: Identify internet-facing Spring AI deployments using the spring-ai-bedrock-converse module (versions 1.0.0–1.0.4 or 1.1.0–1.1.3) by scanning for exposed API endpoints or reviewing application documentation.
2. Craft malicious multimodal message: Construct a multimodal message payload (e.g., a JSON request to the chat API) that includes a user-supplied media URL pointing to an internal target, such as http://169.254.169.254/latest/meta-data/ (AWS IMDSv1) or an internal service endpoint.
3. Submit the payload: Send the crafted request to the application's chat/inference endpoint without any authentication credentials, exploiting the lack of URL validation in BedrockProxyChatModel.
4. Retrieve server response: The server fetches the attacker-specified URL and may return the response content (e.g., cloud credentials, internal service data) in the API response or via an out-of-band channel to an attacker-controlled server.
5. Leverage obtained data: Use any retrieved credentials, tokens, or internal network information for further lateral movement, privilege escalation, or data exfiltration (Spring Advisory, Feedly).

• Network: Outbound HTTP requests from the Spring AI application server to internal IP ranges (e.g., 169.254.169.254, RFC 1918 addresses) or unexpected external hosts; unusual HTTP GET requests to cloud metadata endpoints originating from the application process.
• Logs: Application logs showing BedrockProxyChatModel fetching URLs to internal or non-media destinations; HTTP client logs recording requests to 169.254.169.254 or other internal services; access logs showing multimodal message submissions with suspicious URL parameters.
• Network: Connections from the application server to attacker-controlled infrastructure (out-of-band data exfiltration); DNS lookups for internal hostnames or cloud metadata domains initiated by the Java application process.
• Process: Unexpected network activity from the Java process hosting Spring AI, particularly outbound connections on port 80/443 to internal subnets not associated with AWS Bedrock endpoints.

Spring has released patched versions that resolve this vulnerability: upgrade to Spring AI 1.0.5 (for 1.0.x deployments) or Spring AI 1.1.4 (for 1.1.x deployments); no additional configuration changes are required after upgrading (Spring Advisory). As interim workarounds prior to patching, organizations should implement network-level egress controls to restrict outbound HTTP requests from the application server to only necessary destinations (e.g., AWS Bedrock endpoints), and consider deploying URL allowlisting or a web application firewall to block requests to internal IP ranges. For AWS-hosted deployments, enabling IMDSv2 (which requires a PUT request with a session token) can reduce the risk of metadata service exposure via SSRF.

The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-288) covering this vulnerability shortly after disclosure (CCCS Advisory). Security news outlet The Hacker Wire published coverage specifically on the SSRF via multimodal messages attack vector (The Hacker Wire). The vulnerability was also tracked by Tenable (Nessus plugin 304267) and Qualys (QID 5009974), indicating rapid integration into enterprise vulnerability management tooling (Feedly).