Which versions of Java are affected by CVE-2026-4215?

Organizations using FlowCI flow-core-x should be aware of moderate risk from CVE-2026-4215, a server-side request forgery vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4215?

Yes, a public proof-of-concept exploit is available for CVE-2026-4215. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4215?

Within 30 days: Identify affected systems running FlowCI flow-core-x and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Java CVE-2026-4215

Q: What is the CVSS score of CVE-2026-4215?

CVE-2026-4215 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12331 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-16 VulDB

Java SSRF Flow Core X

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 05:00 euvd

EUVD-2026-12331

Analysis Generated

Mar 16, 2026 - 05:00 vuln.today

CVE Published

Mar 16, 2026 - 04:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in FlowCI flow-core-x up to version 1.23.01 allows authenticated remote attackers to conduct SSRF attacks through the SMTP Host Handler configuration function. Public exploit code exists for this vulnerability and the vendor has not released a patch. An attacker with valid credentials can manipulate the system to make arbitrary outbound requests from the affected server.

Technical ContextAI

This vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a class of flaws where server-side code processes user-supplied input as a request target without proper validation. The affected component is the ConfigServiceImpl.java file in the SMTP Host Handler, part of the flow-core configuration service layer. The Java-based FlowCI application (cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*) fails to properly validate or sanitize SMTP host configuration inputs during the Save operation, allowing attackers to redirect server-initiated requests to arbitrary internal or external systems. This is particularly dangerous in containerized or cloud environments where the server may have access to internal service discovery endpoints, metadata services (e.g., AWS EC2 IMDSv1), or other sensitive infrastructure.

RemediationAI

Immediate patch availability: NO vendor patch is currently available. The vendor was contacted early and did not respond. Recommended mitigations: (1) Upgrade to a version newer than 1.23.01 if released by FlowCI (check official GitHub/downloads); (2) Implement network-level controls restricting outbound requests from the FlowCI server to trusted SMTP hosts only (firewall rules, egress filtering); (3) Require validation of SMTP host inputs to only allow DNS names or IP addresses matching a whitelist; (4) Disable or restrict access to the SMTP Host Handler configuration endpoint to trusted administrators only (strengthen PR:L boundary); (5) Monitor outbound connections from the FlowCI service for anomalous SSRF patterns. Reference: VulDB entries (https://vuldb.com/?id.351139, https://vuldb.com/?ctiid.351139) and public POC (https://github.com/fakebug111/my_public_bug/blob/main/issus01.md). Contact FlowCI directly or monitor their issue tracker for patches.