CVE-2026-22742: Spring AI Bedrock Converse SSRF Vulnerability

CVE-2026-22742 Overview

CVE-2026-22742 is a Server-Side Request Forgery (SSRF) vulnerability affecting Spring AI's spring-ai-bedrock-converse component. The vulnerability exists in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations, potentially exposing sensitive internal resources or enabling further attacks against internal infrastructure.

Critical Impact

Attackers can exploit this SSRF vulnerability to access internal services, cloud metadata endpoints, or other protected resources that should not be accessible from external networks, leading to potential data exfiltration and lateral movement within the infrastructure.

Affected Products

• Spring AI versions 1.0.0 through 1.0.4
• Spring AI versions 1.1.0 through 1.1.3
• Applications using BedrockProxyChatModel with user-supplied media URLs

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-22742 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-22742

Vulnerability Analysis

This SSRF vulnerability resides in the BedrockProxyChatModel class within Spring AI's Bedrock Converse integration. When the application processes multimodal messages containing media content, it accepts user-supplied URLs pointing to external media resources. The vulnerable component fetches these resources server-side without adequate validation of the URL scheme, host, or destination.

The lack of proper URL validation enables attackers to craft malicious URLs that target internal network resources, cloud provider metadata services (such as AWS IMDSv1 at 169.254.169.254), or other sensitive endpoints that would otherwise be inaccessible from external networks. Since the requests originate from the application server itself, they bypass network-level access controls designed to protect internal resources.

Root Cause

The root cause of this vulnerability is insufficient input validation in the URL handling logic within BedrockProxyChatModel. When processing multimodal messages, the component accepts media URLs without verifying that they point to legitimate external resources. The implementation fails to:

1. Validate URL schemes (allowing file://, gopher://, or other dangerous protocols)
2. Block requests to private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1)
3. Prevent DNS rebinding attacks
4. Restrict access to cloud metadata endpoints

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by submitting a multimodal message request to the vulnerable Spring AI application with a crafted media URL. The URL can target internal services, cloud metadata APIs, or other protected resources.

For example, an attacker could submit a media URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ to extract AWS IAM credentials, or target internal services like http://internal-admin-panel:8080/api/secrets. The server-side request bypasses firewall rules since the request originates from within the trusted network.

Technical details regarding the specific vulnerable code paths can be found in the Spring Security Advisory for CVE-2026-22742.

Detection Methods for CVE-2026-22742

Indicators of Compromise

• Outbound HTTP requests from the application server to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1)
• Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
• Unusual outbound connections to non-standard ports from the Spring AI application
• Log entries showing media URL requests with internal hostnames or private IP addresses

Detection Strategies

• Monitor application logs for requests containing internal IP addresses or hostnames in media URL parameters
• Implement network-level monitoring to detect outbound connections from the application server to internal network segments
• Deploy Web Application Firewall (WAF) rules to identify and block SSRF patterns in incoming requests
• Use SentinelOne's behavioral AI to detect anomalous network connection patterns from Java applications

Monitoring Recommendations

• Enable detailed logging for all URL fetch operations in the Spring AI application
• Configure alerting for outbound requests to RFC 1918 private address ranges and link-local addresses
• Monitor for DNS queries resolving to internal IP addresses from the application server
• Implement egress filtering and log all blocked outbound connection attempts

How to Mitigate CVE-2026-22742

Immediate Actions Required

• Upgrade Spring AI to version 1.0.5 or later for the 1.0.x branch
• Upgrade Spring AI to version 1.1.4 or later for the 1.1.x branch
• Review application logs for any evidence of SSRF exploitation attempts
• Audit any systems or services that may have been accessed via SSRF

Patch Information

Spring has released patched versions that include proper URL validation for media URLs in BedrockProxyChatModel. The patches add allowlist-based URL validation and block requests to private IP ranges, localhost, and cloud metadata endpoints.

For detailed patch information and upgrade instructions, refer to the Spring Security Advisory for CVE-2026-22742.

Workarounds

• Implement a reverse proxy or WAF in front of the application that validates and sanitizes all incoming media URLs
• Configure network-level egress filtering to block the application server from connecting to internal resources and cloud metadata endpoints
• Deploy URL allowlisting at the application layer to restrict media URLs to known-safe domains
• Disable the multimodal message functionality in BedrockProxyChatModel if not required for business operations

# Example: Block metadata endpoint access via iptables
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP