CVE-2026-62242
High
Description
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
SeverityHigh
CVSS8.6
Exploit probability—
ProductCodecentric Spring-boot-admin
PublishedJul 13, 2026
First seenJul 13, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- codecentric spring-boot-admin4.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| codecentric spring-boot-admin | v < 4.1.2 | 4.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.