Security readout for executives and security teams
Plain-English summary
A flaw in Spring AI's Bedrock chat integration lets an attacker trick the server into fetching content from web addresses the attacker chooses. Because the server makes those requests on the user's behalf, it can be steered toward internal systems that should never be reachable from outside, potentially exposing sensitive metadata or internal services through the application.
Executive priority
Prioritize patching within standard high-severity SLA. The vulnerability is remotely exploitable without authentication and scoped to a specific Spring AI component, so impact depends on whether your applications use the affected Bedrock proxy with user-supplied media URLs. Treat as a targeted upgrade rather than a fleet-wide emergency, but do not defer.
Technical view
CVE-2026-22742 is a Server-Side Request Forgery (CWE-918) in Spring AI's spring-ai-bedrock-converse module. BedrockProxyChatModel accepts user-supplied media URLs in multimodal messages without sufficient validation, causing the server to issue outbound HTTP requests to attacker-controlled destinations. Affected versions: 1.0.0 before 1.0.5 and 1.1.0 before 1.1.4. CVSS 3.1 score is 8.6 with scope change (AV:N/AC:L/PR:N/UI:N/S:C/C:H).
Likely exposure
Applications built on Spring AI 1.0.0–1.0.4 or 1.1.0–1.1.3 that expose BedrockProxyChatModel and accept multimodal prompts containing user-supplied media URLs. Risk is elevated for services deployed in cloud environments where reachable internal endpoints (metadata services, internal APIs, admin consoles) increase the blast radius of a successful SSRF.
Exploitation context
No active exploitation is cited in the source bundle and the CVE is not listed in CISA KEV. The advisory was published 2026-03-27 and updated 2026-05-10, indicating recent vendor attention. CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated abuse is feasible where the affected endpoint accepts external media URLs.
Researcher notes
CVSS scope is Changed (S:C) with high confidentiality impact and no integrity or availability impact, consistent with SSRF used for information disclosure rather than data tampering. The advisory lists two affected version lines (1.0.x and 1.1.x), so verify both branches in any deployment. No public PoC, KEV listing, or exploitation reporting is referenced in the provided bundle; revisit vendor advisory for any post-disclosure updates.
Mitigation direction
- Upgrade Spring AI to 1.0.5 or 1.1.4 per the vendor advisory at spring.io/security/cve-2026-22742.
- Inventory services using spring-ai-bedrock-converse and BedrockProxyChatModel.
- Restrict outbound egress from AI service hosts to only required destinations.
- Block requests to internal address ranges and cloud metadata endpoints at the network layer.
- Validate and allowlist media URL schemes and hosts before passing them to the model.
- Consult Spring's security advisory for any additional vendor-recommended guidance.
Validation and detection
- Identify Spring AI dependency versions via build manifests (pom.xml, build.gradle).
- Confirm whether BedrockProxyChatModel is configured and reachable by external clients.
- Review application logs for outbound fetches triggered by chat media URLs.
- After upgrade, verify the resolved spring-ai-bedrock-converse version is 1.0.5+ or 1.1.4+.
- Re-test multimodal endpoints to confirm internal targets and metadata endpoints are no longer reachable.
- Monitor egress traffic from AI workloads for anomalous outbound destinations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22742 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94vmwareVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://spring.io/security/cve-2026-22742CVE reference, vmware
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.