CVE-2026-92569 describes an SSRF vulnerability in Hippo4j through version 1.5.0. The flaw exists because four ThreadPoolController endpoints fail to validate the clientAddress parameter, enabling authenticated attackers to supply arbitrary hostnames and ports. This can trigger outbound GET requests to internal network resources and cloud metadata services, potentially exposing sensitive internal information or enabling further attacks.

An authenticated attacker can exploit this vulnerability to make unauthorized outbound HTTP requests from the affected server to internal network resources or cloud metadata services. This may lead to information disclosure or facilitate further attacks within the internal environment. The CVSS score of 4.3 indicates a medium impact primarily due to limited confidentiality impact and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the vulnerable endpoints to trusted users and consider network-level controls to limit outbound requests from the affected service.