AIKIDO-2026-778801

spring-boot-admin-server is vulnerable to Server-Side Request Forgery (SSRF)

CVE-2026-62242Published Aug 3, 2026

CVE Score

High

Server-Side Request Forgery (SSRF)

TL;DR

Spring Boot Admin Server registers monitored application instances through an endpoint that accepts caller-supplied healthUrl, managementUrl, and serviceUrl values and by default requires no authentication. The registered URLs are not validated against loopback, private-network, or cloud metadata addresses before the server begins polling them and exposing an actuator proxy that forwards requests to the registered management endpoint. Externally influenced registration data can therefore drive the server into issuing outbound requests to internal services and metadata endpoints and returning their response bodies, disclosing internal data such as cloud credentials. The fix introduces an SsrfUrlValidator and InetAddressFilter that validate schemes and block private or metadata addresses during registration and proxying.

How do I fix this?

Upgrade the de.codecentric:spring-boot-admin-starter-server library to the patch version.

Who does this affect?

You are affected if you run Spring Boot Admin Server (the spring-boot-admin-server component, for example via the de.codecentric:spring-boot-admin-starter-server starter) below 4.1.2 with the instance-registration endpoint reachable. By default that endpoint requires no authentication and performs no address validation, so any caller that can reach it can register instances with externally influenced healthUrl, managementUrl, and serviceUrl values and drive the server into making outbound requests to loopback, private-network, or cloud-metadata addresses (e.g. 169.254.169.254) and returning their response bodies. Deployments that isolate the registration endpoint from untrusted networks and callers are at reduced risk, but no in-product URL validation existed before 4.1.2.