CVE-2026-62242CWE-918ssrf

CVE-2026-62242

High · published July 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-14T02:16Z
References (6)
https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551 · [email protected]https://github.com/codecentric/spring-boot-admin/issues/5452 · [email protected]https://github.com/codecentric/spring-boot-admin/pull/5464 · [email protected]https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2 · [email protected]https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration · [email protected]https://github.com/codecentric/spring-boot-admin/issues/5452 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 JUL 21:04Z
    Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
    cvelistv5