CVE-2026-62242: Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62242?
The severity of CVE-2026-62242 is rated high with a CVSS score of 7.7.
How does CVE-2026-62242 affect my system?
CVE-2026-62242 allows unauthenticated attackers to exploit server-side request forgery by registering malicious instances using unvalidated URLs.
How do I fix CVE-2026-62242?
To fix CVE-2026-62242, upgrade your Spring Boot Admin Server to version 4.1.2 or later.
What kind of attacks are possible with CVE-2026-62242?
CVE-2026-62242 can be exploited to allow attackers to send requests from the server to internal network services, potentially leading to data exposure.
Is my Spring Boot Admin Server vulnerable to CVE-2026-62242?
If you are using Spring Boot Admin Server version earlier than 4.1.2, your system is vulnerable to CVE-2026-62242.