{"id":"CVE-2026-92569","title":"Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter","summary":"Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trig…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-918"],"vendor":"opengoofy","product":"hippo4j","affected":["hippo4j <= 1.5.0"],"published":"2026-09-16","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:19:16.877","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92569","references":[{"url":"https://github.com/opengoofy/hippo4j","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opengoofy/hippo4j/issues/1621","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter","label":"disclosure@vulncheck.com"},{"url":"https://github.com/opengoofy/hippo4j/issues/1621","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00272,"epssPercentile":0.19796,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-21T16:04:25.375885Z"},"ingestedAt":"2026-09-16T14:57:28.040Z","slug":"CVE-2026-92569","body":"## Overview\n\nHippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208594,"id":"CVE-2026-92569","ts":1790009384622,"field":"exploit_available","old":"false","new":"true"}]}