CVE-2026-62242highCWE-918

CVE-2026-62242: high-severity vulnerability in codecentric spring-boot-admin

Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Published · Updated

Follow this CVE+ Monitor spring-boot-admin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.7epss 0.4%
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
codecentric · spring-boot-admin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — codecentric spring-boot-admin

In the same product, most dangerous first.

CVE-2022-46166HIGHSpring Boot Admins integrated notifier support allows arbitrary code executionEPSS 1.6%