CVE-2026-62242

Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Published Jul 13, 2026 CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Description

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.

Analysis

Technical impact

Spring Boot Admin Server versions prior to 4.1.2 contain a Server‑Side Request Forgery flaw that allows an unauthenticated attacker to register new instances with arbitrary healthUrl and managementUrl values. The server blindly follows those URLs and returns the resulting response bodies through the actuator proxy, giving the attacker access to internal network endpoints, cloud metadata services, and other sensitive resources.

Affected Systems

The vulnerability affects Spring Boot Admin Server from the vendor codecentric, specifically all releases older than version 4.1.2.

Risk and Exploitability

The CVSS score of 7.7 classifies the vulnerability as high severity. A low EPSS score of less than 1% indicates a small but non‑zero exploit probability, and the flaw is not listed in the CISA KEV catalog. The lack of authentication for instance registration makes exploitation straightforward. An attacker who can reach the registration endpoint can force the server to request any internal address, potentially retrieving cloud credentials or other secrets, and exfiltrate them via the returned response bodies.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

codecentric

spring-boot-admin

unaffected

Version	Status	Constraints
`0`	affected	< 4.1.2

No data.

Vendor Product Versions

Codecentric

Spring Boot Admin

Version	Status	Scheme	Platform
`[0,4.1.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Spring Boot Admin Server to version 4.1.2 or later, which removes the unauthenticated instance registration path.
If an upgrade cannot be performed immediately, disable or restrict the instance registration endpoint or enforce authentication to limit who can register instances.
Configure network firewalls or service controls to block outbound requests from the admin server to internal or metadata addresses until the vulnerability is addressed.

Generated by OpenCVE AI on July 31, 2026 at 11:18 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.371% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551
https://github.com/codecentric/spring-boot-admin/issues/5452
https://github.com/codecentric/spring-boot-admin/pull/5464
https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2
https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 10:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:codecentric:spring_boot_admin::::::::

Jul 13, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Codecentric Codecentric spring Boot Admin
Vendors & Products		Codecentric Codecentric spring Boot Admin

Jul 13, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
Title		Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
Weaknesses		CWE-918
References		https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551 https://github.com/codecentric/spring-boot-admin/issues/5452 https://github.com/codecentric/spring-boot-admin/pull/5464 https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2 https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}`