CVE-2026-62242: Spring Boot Admin Server SSRF Vulnerability

CVE-2026-62242 Overview

CVE-2026-62242 is a Server-Side Request Forgery (SSRF) vulnerability affecting Spring Boot Admin Server versions before 4.1.2. The flaw resides in the instance registration endpoint, which accepts attacker-controlled healthUrl and managementUrl parameters without validating them against private IP ranges or cloud metadata endpoints. Unauthenticated attackers can register malicious instances and force the server to issue HTTP requests to arbitrary internal addresses. Response bodies are retrievable through the actuator proxy, enabling exfiltration of cloud credentials from services such as AWS Instance Metadata Service (IMDS). The vulnerability is tracked under CWE-918.

Critical Impact
Unauthenticated attackers can pivot into internal networks and exfiltrate cloud credentials from metadata endpoints, exposing the entire cloud environment to compromise.

Affected Products

Spring Boot Admin Server versions prior to 4.1.2
Deployments exposing the instance registration endpoint without authentication
Cloud-hosted instances relying on IMDS or internal service discovery

Discovery Timeline

2026-07-13 - CVE-2026-62242 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62242

Vulnerability Analysis

Spring Boot Admin Server provides a management UI for monitoring Spring Boot applications. Client applications register themselves by POSTing a JSON payload to the /instances endpoint, supplying healthUrl and managementUrl fields. Before version 4.1.2, the server accepts these URLs without sanitization or allowlisting.

Once an instance is registered, the admin server issues outbound HTTP requests to the supplied URLs to collect health data and actuator metrics. Because responses are surfaced back through the actuator proxy, an attacker can read the response body of any address reachable from the server.

The registration endpoint is unauthenticated by default in typical deployments, meaning no credentials are required to trigger the SSRF. The vulnerability is classified as CWE-918: Server-Side Request Forgery.

Root Cause

The root cause is missing input validation on user-controlled URL parameters. The server does not enforce an allowlist of permitted hosts, block loopback addresses, reject RFC 1918 private ranges, or filter cloud metadata IPs such as 169.254.169.254. The fix in commit 1f991ea013e46360b8f8fb63fe4ad20a9bf0d551 introduces an optional SSRF check mechanism through AdminServerAutoConfiguration and AdminServerProperties.

Attack Vector

An attacker sends an unauthenticated POST request to the /instances endpoint with healthUrl pointing to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The admin server retrieves the URL, caches the response, and exposes it through the actuator proxy for retrieval by the attacker.

java

// Security patch: AdminServerAutoConfiguration.java
// fix(#5452): add optional ssrf check mechanism (#5464)
/*
 * Copyright 2014-2026 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 */

Source: GitHub Commit 1f991ea

Detection Methods for CVE-2026-62242

Indicators of Compromise

POST requests to /instances originating from external or unexpected source IPs
Registration payloads containing healthUrl or managementUrl values referencing loopback, RFC 1918, link-local (169.254.0.0/16), or cloud metadata addresses
Outbound HTTP requests from the admin server to 169.254.169.254, metadata.google.internal, or metadata.azure.com
Actuator proxy responses containing credential material such as AWS SecretAccessKey or Token fields

Detection Strategies

Inspect Spring Boot Admin Server access logs for /instances POST requests containing suspicious URL schemes or private IP ranges
Monitor egress traffic from admin server hosts for connections to cloud metadata endpoints
Alert on actuator proxy responses whose sizes or patterns match cloud credential documents

Monitoring Recommendations

Enable HTTP request logging with full payload capture on the admin server behind an authentication proxy
Correlate admin server outbound flows against a baseline of expected registered instances
Deploy egress firewall rules that block admin server hosts from reaching metadata service IPs and log all denied attempts

How to Mitigate CVE-2026-62242

Immediate Actions Required

Upgrade Spring Boot Admin Server to version 4.1.2 or later immediately
Place the admin server behind an authentication layer such as Spring Security with basic auth or OAuth2
Block outbound access from the admin server host to cloud metadata endpoints and internal management networks
Rotate any cloud credentials, API tokens, or service account keys accessible from the admin server host

Patch Information

The upstream fix ships in Spring Boot Admin release 4.1.2 via Pull Request #5464, which resolves Issue #5452. The change adds an optional SSRF check mechanism that validates registration URLs. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict network access to the /instances endpoint using a reverse proxy or WAF rule that requires authentication
Configure IMDSv2 with hop-limit of 1 on AWS EC2 to block SSRF-based metadata retrieval
Deploy egress network policies preventing the admin server from reaching link-local addresses and private ranges outside its expected scope
Enable the SSRF check mechanism introduced in 4.1.2 and configure an allowlist of permitted registration URLs

bash

# Upgrade Spring Boot Admin Server to patched version
# Maven
mvn versions:use-dep-version -Dincludes=de.codecentric:spring-boot-admin-starter-server -DdepVersion=4.1.2

# Gradle (build.gradle)
# implementation 'de.codecentric:spring-boot-admin-starter-server:4.1.2'

# Verify installed version
mvn dependency:tree | grep spring-boot-admin