de.codecentric/spring-boot-admin vulnerabilities

Latest de.codecentric/spring-boot-admin CVEs

Newest publication first

1. CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

   Published 2026-07-13

   High·CVSS 7.7

   Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoint...

2. CVE-2022-46166 Spring Boot Admins integrated notifier support allows arbitrary code execution

   Published 2022-12-09

   Critical·CVSS 9.8 EPSS 1.6%

   Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advis...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.