CVE-2026-92569: Hippo4j through 1.5.0 SSRF via clientAddress Parameter
Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access to the affected Hippo4j application. The published vector requires only low privileges and no user interaction.
What systems can be reached through the vulnerable requests?
The attacker can provide arbitrary hostnames and ports in the clientAddress parameter, causing outbound GET requests. This can expose internal network services and cloud metadata services that are reachable from the Hippo4j server.
Which deployments are affected?
Hippo4j versions through 1.5.0 are identified as affected. The issue is in four ThreadPoolController endpoints that do not validate clientAddress.