Spring Boot Admin Server versions prior to 4.1.2 contain a Server‑Side Request Forgery flaw that allows an unauthenticated attacker to register new instances with arbitrary healthUrl and managementUrl values. The server blindly follows those URLs and returns the resulting response bodies through the actuator proxy, giving the attacker access to internal network endpoints, cloud metadata services, and other sensitive resources.

The vulnerability affects Spring Boot Admin Server from the vendor codecentric, specifically all releases older than version 4.1.2.

The CVSS score of 7.7 classifies the vulnerability as high severity. A low EPSS score of less than 1% indicates a small but non‑zero exploit probability, and the flaw is not listed in the CISA KEV catalog. The lack of authentication for instance registration makes exploitation straightforward. An attacker who can reach the registration endpoint can force the server to request any internal address, potentially retrieving cloud credentials or other secrets, and exfiltrate them via the returned response bodies.