Server-side Request Forgery in Hippo4j Affects Cloud Metadata Services
CVE-2026-92569

5.3MEDIUM

Key Information:

Vendor

Opengoofy

Status
Hippo4j
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92569?

Hippo4j version 1.5.0 contains a server-side request forgery vulnerability affecting four endpoints within the ThreadPoolController. This flaw arises from inadequate validation of the clientAddress parameter, allowing authenticated attackers to supply arbitrary hostnames and ports. By doing so, they can trigger outbound GET requests, potentially exposing internal network services and sensitive cloud metadata. Proper mitigation strategies are essential to safeguard these endpoints.

Affected Version(s)

hippo4j 0 <= 1.5.0

References

https://github.com/opengoofy/hippo4j/issues/1621
issue-tracking
https://github.com/opengoofy/hippo4j
product
https://github.com/opengoofy/hippo4j/blob/73124de92e26994...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.