Spring AI's spring-ai-bedrock-converse component contains an SSRF vulnerability (CWE-918) in the BedrockProxyChatModel when handling multimodal messages that include user-supplied media URLs. The lack of sufficient validation allows attackers to induce the server to issue HTTP requests to arbitrary internal or external destinations. This affects versions 1.0.0 up to but not including 1.0.5, and 1.1.0 up to but not including 1.1.4. The vulnerability is publicly known as of March 27, 2026, with a CVSS 3.1 base score of 8.6, indicating high severity. There is no information about an available patch or official remediation from the vendor in the provided data.

Successful exploitation allows an unauthenticated attacker to cause the affected server to make HTTP requests to unintended destinations, potentially accessing internal services or sensitive resources. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted user-supplied media URLs or implement strict validation and filtering of URLs before they are processed by the BedrockProxyChatModel component.