Package Health/de.codecentric:spring-boot-admin-server

de.codecentric:spring-boot-admin-server

A security policy is absent, but eight contributors were active recently and the organization-backed project has ongoing issue and release activity. The published release includes notes, tests exist in the repository, and Maven signing supports traceability.

Latest 4.1.2

Maven

82%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Security policy

No repository security policy was found, leaving vulnerability-reporting guidance less transparent for consumers.

Workflow audit

All 30 referenced actions are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection and unpinned-image hygiene issues, but no untrusted checkout or script-injection trigger was reported.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-778801 spring-boot-admin-server is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 4.1.1.	0.0.1 - 4.1.1	High
AIKIDO-2026-10097 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. spring-boot-admin-server is vulnerable to Remote Code Execution (RCE) in versions 0.0.1 - 3.5.6.	0.0.1 - 3.5.6	High
CVE-2023-38286 de.codecentric:spring-boot-admin-server is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 3.0.0 - 3.1.2 and 0.0.0 - 2.7.16.	0.0.0 - 2.7.163.0.0 - 3.1.2	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.springframework.boot:spring-boot-starter Version 4.1.0	—	—
org.springframework.boot:spring-boot-starter-webclient Version 4.1.0	—	—
org.springframework.boot:spring-boot-starter-hazelcast Version 4.1.0	—	—
org.springframework.boot:spring-boot-starter-webflux Version 4.1.0	—	—
org.springframework.boot:spring-boot-starter-webmvc Version 4.1.0	—	—