CVE-2026-22742

{
  "id": "CVE-2026-22742",
  "sourceIdentifier": "[email protected]",
  "published": "2026-03-27T06:16:37.833",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4."
    },
    {
      "lang": "es",
      "value": "El componente spring-ai-bedrock-converse de Spring AI contiene una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en BedrockProxyChatModel al procesar mensajes multimodales que incluyen URLs de medios proporcionadas por el usuario. La validación insuficiente de esas URLs permite a un atacante inducir al servidor a emitir peticiones HTTP a destinos internos o externos no deseados.\nEste problema afecta a Spring AI: desde 1.0.0 anterior a 1.0.5, desde 1.1.0 anterior a 1.1.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring AI",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.0.0",
              "lessThan": "1.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "1.1.0",
              "lessThan": "1.1.4",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-03-27T19:24:16.998653Z",
          "id": "CVE-2026-22742",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.0.0",
              "versionEndExcluding": "1.0.5",
              "matchCriteriaId": "28BAEC64-E23B-478B-B206-5580BB00516F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.1.0",
              "versionEndExcluding": "1.1.4",
              "matchCriteriaId": "E3774C35-AE82-486B-8E13-8FCC34D3CA30"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-22742",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}