CVE-2026-22742 Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching
Attackers can exploit unvalidated media URLs in Spring AI to force server-side requests to internal or external destinations, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22742?
CVE-2026-22742 is a high-severity server-side request forgery vulnerability in Spring AI, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
Weakness: CWE-918
Which versions are affected by CVE-2026-22742?
4 open source packages ship an affected version, including org.springframework.ai:spring-ai-bedrock-converse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.ai:spring-ai-bedrock-converse Maven | From 1.0.0-M5 | 1.0.5 |
org.springframework.ai:spring-ai-bedrock-converse Maven | From 1.0.0-M5 | 1.0.5 |
org.springframework.ai:spring-ai-bedrock-converse Maven | From 1.1.0-M1 | 1.1.4 |
org.springframework.ai:spring-ai-bedrock-converse Maven | From 1.1.0-M1 | 1.1.4 |
Products include Vmware Spring Ai.
How do I fix CVE-2026-22742?
Upgrade org.springframework.ai:spring-ai-bedrock-converse to a fixed version for your release line: 1.0.5 or 1.1.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-22742 being exploited?
There is no known exploitation of CVE-2026-22742 in the wild and no public exploit code.
Other vulnerabilities in Spring AI
- CVE-2026-22738 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
- CVE-2026-40978 Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
- CVE-2026-22730 CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
- CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-41705 Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
Sources
Also known as GHSA-mhrg-94vw-45c5, MINI-vc26-cjvr-rvmp, MINI-vx66-w43x-c84h.