CVE-2026-22742

Deeper analysis

CVE-2026-22742 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, in the BedrockProxyChatModel component of Spring AI's spring-ai-bedrock-converse module. The flaw arises from insufficient validation of user-supplied media URLs in multimodal messages, enabling the server to issue HTTP requests to unintended internal or external destinations. It affects Spring AI versions from 1.0.0 before 1.0.5 and from 1.1.0 before 1.1.4, with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low complexity, lack of required privileges or user interaction, cross-scope impact, and high confidentiality consequences.

Remote, unauthenticated attackers can exploit this vulnerability by submitting multimodal messages containing malicious media URLs to a vulnerable Spring AI application. Successful exploitation induces the server to make unauthorized HTTP requests on the attacker's behalf, potentially allowing access to internal network resources, metadata services, or external endpoints that the server can reach but users cannot. While integrity and availability are not directly impacted, the high confidentiality score reflects risks such as data exfiltration from behind firewalls or cloud metadata exposure.

The official Spring security advisory at https://spring.io/security/cve-2026-22742 details the issue and recommends upgrading to Spring AI 1.0.5 or later for the 1.0.x branch, or 1.1.4 or later for the 1.1.x branch, as these versions include fixes for URL validation.

This vulnerability is relevant to AI/ML practitioners using Spring AI integrations with AWS Bedrock for conversational models, highlighting risks in proxying user-supplied content in multimodal AI workflows. No public reports of real-world exploitation were available as of the CVE publication on 2026-03-27.