CVE-2026-22742 - Vulnerability Analysis

Overview

Spring AI spring-ai-bedrock-converse from 1.0.0 before 1.0.5 and from 1.1.0 before 1.1.4 contains a server-side request forgery caused by insufficient validation of user-supplied media URLs in BedrockProxyChatModel, letting attackers induce the server to make HTTP requests to unintended destinations, exploit requires crafted multimodal messages with media URLs.

Severity & Score

Impact

Attackers can make the server send HTTP requests to internal or external unintended destinations, potentially accessing sensitive internal resources or causing other impacts.

Mitigation

Upgrade to versions 1.0.5, 1.1.4 or later.

References

• https://spring.io/security/cve-2026-22742

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner