High severity · published Jul 13, 2026
CVE-2026-62242
Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
spring-boot-admin · codecentric
before 4.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62242
github.com
https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551
github.com
https://github.com/codecentric/spring-boot-admin/issues/5452
github.com
https://github.com/codecentric/spring-boot-admin/pull/5464
github.com
https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2
www.vulncheck.com
https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration
More from spring-boot-admin
9.8
CVE-2022-46166
Spring boot admins is an open source administrative user interface for management of spring boot applications
7.5
CVE-2023-38286
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML