AIKIDO-2026-778801

spring-boot-admin-server is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-62242 Published 4 days ago

High Risk

This Affects:

spring-boot-admin-server

0.0.1 - 4.1.1

Fixed in 4.1.2

Are you affected? Scan for Free

TL;DR

Spring Boot Admin Server registers monitored application instances through an endpoint that accepts caller-supplied healthUrl, managementUrl, and serviceUrl values and by default requires no authentication. The registered URLs are not validated against loopback, private-network, or cloud metadata addresses before the server begins polling them and exposing an actuator proxy that forwards requests to the registered management endpoint. Externally influenced registration data can therefore drive the server into issuing outbound requests to internal services and metadata endpoints and returning their response bodies, disclosing internal data such as cloud credentials. The fix introduces an SsrfUrlValidator and InetAddressFilter that validate schemes and block private or metadata addresses during registration and proxying.

Who does this affect?

You are affected if you run Spring Boot Admin Server (the spring-boot-admin-server component, for example via the de.codecentric:spring-boot-admin-starter-server starter) below 4.1.2 with the instance-registration endpoint reachable. By default that endpoint requires no authentication and performs no address validation, so any caller that can reach it can register instances with externally influenced healthUrl, managementUrl, and serviceUrl values and drive the server into making outbound requests to loopback, private-network, or cloud-metadata addresses (e.g. 169.254.169.254) and returning their response bodies. Deployments that isolate the registration endpoint from untrusted networks and callers are at reduced risk, but no in-product URL validation existed before 4.1.2.