What’s Vulnerable › Vulnerabilities

CVE-2026-92569: Hippo4j through 1.5.0 SSRF via clientAddress Parameter

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-24
• Weakness: CWE-918

Description

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

Affected products

• opengoofy hippo4j: through 1.5.0

References

• https://github.com/opengoofy/hippo4j
• https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107
• https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179
• https://github.com/opengoofy/hippo4j/issues/1621
• https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter
• https://github.com/opengoofy/hippo4j/issues/1621

Get alerted when CVE-2026-92569 or the next vulnerability affects your stack