CVE-2026-92569 opengoofy CVE debrief

Who should care

Defenders responsible for Hippo4j instances, especially those with authenticated access, should assess exposure and potential impact on internal networks and cloud services. This includes reviewing authentication configurations, monitoring for suspicious activity, and implementing compensating controls as needed. Additionally, security teams should prioritize verifying exposure of affected systems and assessing potential impact on internal networks and

Why it matters

CVE-2026-92569 is a server-side request forgery vulnerability in Hippo4j through 1.5.0 that allows authenticated attackers to trigger outbound GET requests to internal networks and cloud metadata services. Defenders should prioritize verifying exposure of Hippo4j instances, especially those with authenticated access, and assess potential impact on internal networks and cloud services.

• Potential unauthorized access to internal networks
• Possible exposure of cloud metadata services
• Risk of sensitive data leakage
• Need for verification of affected versions and deployment contexts

Technical summary

The vulnerability exists in four ThreadPoolController endpoints of Hippo4j through 1.5.0, where the clientAddress parameter is not validated, allowing authenticated attackers to trigger outbound GET requests to arbitrary hostnames and ports. This can lead to potential unauthorized access to internal networks, possible exposure of cloud metadata services, and risk of sensitive data leakage. Defenders should prioritize verifying exposure of Hippo4j instances, especially those with authenticated access, and assess potential impact on internal networks and cloud services.

Defensive priority

Defenders should prioritize verifying exposure of Hippo4j instances, especially those with authenticated access, and assess potential impact on internal networks and cloud services.

Recommended defensive actions

• Verify Hippo4j instance exposure and authentication configurations
• Assess potential impact on internal networks and cloud services
• Monitor for suspicious outbound requests
• Consider implementing compensating controls for sensitive services
• Review vendor patch guidance and apply updates
• Conduct exposure review for affected systems
• Implement monitoring and asset inventory processes

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact on specific deployment contexts requires further verification. The vulnerability exists in four ThreadPoolController endpoints of Hippo4j through 1.5.0, where the clientAddress parameter is not validated, allowing authenticated attackers to trigger outbound GET requests to arbitrary hostnames and ports. Defenders should verify Hippo4j instance exposure and authentication configurations, assess potential of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.