What is CVE-2026-92569?

CVE-2026-92569 is a medium-severity vulnerability in Opengoofy Hippo4j, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.3/10. Published 2026-09-16.

How severe is CVE-2026-92569?

Medium severity. CVSS v3 base score is 4.3 out of 10.

SSRF in Opengoofy Hippo4j

CVE-2026-92569

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Opengoofy Hippo4j

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-92569?: CVE-2026-92569 is a medium-severity vulnerability in Opengoofy Hippo4j, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.3/10. Published 2026-09-16.
How severe is CVE-2026-92569?: Medium severity. CVSS v3 base score is 4.3 out of 10.