Is CVE-2026-22742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22742 being exploited in the wild.

How severe is CVE-2026-22742?

High severity, with a CVSS score of 8.6, published 27 March 2026.

Which products and versions are affected?

org.springframework.ai:spring-ai-bedrock-converse (Maven) ECOSYSTEM:introduced=1.0.0-M5,fixed=1.0.5.

Is there a fix for CVE-2026-22742?

Yes. org.springframework.ai:spring-ai-bedrock-converse (Maven): upgrade to 1.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22742 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22742?

Check whether you run org.springframework.ai:spring-ai-bedrock-converse (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22742: Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

CVE-2026-22742 · Severity: high · CVSS 8.6 · Published 2026-03-27

Spring AI is a framework used by developers to integrate artificial intelligence capabilities into Java applications. A security flaw in its Amazon Bedrock integration allows attackers to force the application to make unauthorized network requests. This could lead to the exposure of sensitive internal data or allow attackers to bypass firewalls to reach private internal services.

Vendors: Maven.

Quick answers

Is CVE-2026-22742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22742 being exploited in the wild.
How severe is CVE-2026-22742?: High severity, with a CVSS score of 8.6, published 27 March 2026.
Which products and versions are affected?: org.springframework.ai:spring-ai-bedrock-converse (Maven) ECOSYSTEM:introduced=1.0.0-M5,fixed=1.0.5.
Is there a fix for CVE-2026-22742?: Yes. org.springframework.ai:spring-ai-bedrock-converse (Maven): upgrade to 1.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22742 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22742?: Check whether you run org.springframework.ai:spring-ai-bedrock-converse (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.ai:spring-ai-bedrock-converse (Maven): upgrade to 1.0.5 or later

# set org.springframework.ai:spring-ai-bedrock-converse to 1.0.5 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the BedrockProxyChatModel component of Spring AI. The vulnerability is rooted in the insufficient validation of user-supplied media URLs within multimodal messages. A remote, unauthenticated attacker can exploit this by providing a specially crafted URL, causing the server to initiate outbound HTTP requests to arbitrary internal or external IP addresses. This can be used to scan internal networks, access metadata services, or pivot to other internal resources. The issue is fixed in Spring AI versions 1.0.5 and 1.1.4.

Affected products

VMware Spring AI 1.0.0 to 1.0.4, 1.1.0 to 1.1.3

Identifiers

CVE-2026-22742
GHSA-mhrg-94vw-45c5

Timeline

2026-03-27: advisory: Initial advisory published by VMware and NVD

References

https://spring.io/security/cve-2026-22742

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.