---
id: CVE-2026-92569
title: >-
  Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in
  four ThreadPoolController endpoints that fail to validate the clientAddress
  parameter
summary: >-
  Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in
  four ThreadPoolController endpoints that fail to validate the clientAddress
  parameter. Authenticated attackers can supply arbitrary hostnames and ports to
  trig…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: opengoofy
product: hippo4j
affected:
  - hippo4j <= 1.5.0
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92569'
references:
  - url: 'https://github.com/opengoofy/hippo4j'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179
    label: disclosure@vulncheck.com
  - url: 'https://github.com/opengoofy/hippo4j/issues/1621'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter
    label: disclosure@vulncheck.com
  - url: 'https://github.com/opengoofy/hippo4j/issues/1621'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00342
epssPercentile: 0.24944
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T16:04:25.375885Z'
ingestedAt: '2026-09-16T14:57:28.040Z'
---

## Overview

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.