CVE-2026-62242

Name of the Vulnerable Software and Affected Versions Spring Boot Admin Server versions prior to 4.1.2

Description An issue exists where unauthenticated attackers can register instances using attacker-controlled healthUrl and managementUrl parameters. Due to a lack of validation against private IP ranges or metadata endpoints, the server can be forced to make HTTP requests to arbitrary internal addresses. This allows the retrieval of response bodies via the actuator proxy to exfiltrate cloud credentials. This is a server-side request forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 4.1.2 or later. Restrict the use of healthUrl and managementUrl parameters during instance registration until the update is applied.