Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-62242Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

High 8.6

In plain English

A high-severity server-side request forgery in spring-boot-admin from codecentric. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.

Affected products (as reported)

Vendor	Product	Versions
codecentric	spring-boot-admin	0 – before 4.1.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

spring-boot-admin 4.1.2 Release Notes release-notes, patch
Researcher Disclosure technical-description, exploit, issue-tracking
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration third-party-advisory