CVE-2026-92569Published
Hippo4j through 1.5.0 SSRF via clientAddress Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-92569 · Microsoft / collected KEV context
cve-program · CVE-2026-92569
- https://github.com/opengoofy/hippo4j/issues/1621
- https://github.com/opengoofy/hippo4j
- https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-console/src/main/java/cn/hippo4j/console/controller/ThreadPoolController.java#L123-L179
- https://github.com/opengoofy/hippo4j/blob/73124de92e269940bdf44f4534b37a13a36ffd49/hippo4j-server/hippo4j-auth/src/main/java/cn/hippo4j/auth/config/GlobalSecurityConfig.java#L95-L107
- https://www.vulncheck.com/advisories/hippo4j-through-1.5.0-ssrf-via-clientaddress-parameter
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.