Spring Boot Admin Server SSRF via Unvalidated HealthUrl

Executive Summary

CVE-2026-62242 is a server-side request forgery (SSRF) vulnerability in Spring Boot Admin Server versions before 4.1.2. This vulnerability allows unauthenticated attackers to register instances with the server by providing attacker-controlled healthUrl and managementUrl parameters.

The vulnerability arises due to a lack of validation against private IP ranges or metadata endpoints. Attackers can exploit this to force the server to make HTTP requests to arbitrary internal addresses. Additionally, they can retrieve response bodies via the actuator proxy, which may allow exfiltration of sensitive information such as cloud credentials.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your Spring Boot Admin Server version is before 4.1.2 and verifying if unauthenticated instance registration is possible with attacker-controlled parameters.

• Check the version of Spring Boot Admin Server running in your environment. If it is before 4.1.2, it is vulnerable.
• Test for unauthenticated instance registration by attempting to register an instance with manipulated healthUrl or managementUrl parameters pointing to internal or arbitrary addresses. For example, you can use curl commands to send a POST request to the /instances endpoint with crafted parameters.

Example curl command to test for unauthenticated registration:

• curl -X POST 'http://<admin-server-address>/instances' -H 'Content-Type: application/json' -d '{"name": "test-instance", "healthUrl": "http://attacker-controlled-address/health", "managementUrl": "http://internal-ip/actuator"}'

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts on affected systems and organizations:

• Unauthorized access to internal systems: Attackers can force the Spring Boot Admin Server to make requests to internal services or systems that are not exposed to the public internet, potentially accessing sensitive data or functionality.
• Exfiltration of sensitive information: By leveraging the actuator proxy, attackers can retrieve response bodies from internal requests, which may include cloud credentials, API keys, or other confidential data.
• Compromise of cloud environments: If cloud credentials are exposed, attackers could gain unauthorized access to cloud resources, leading to further exploitation, data breaches, or service disruption.
• Reputation and trust damage: A successful exploit could erode customer or stakeholder trust, especially if sensitive data is exposed or misused.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or exfiltration of personal data, it could result in a violation of GDPR. Organizations may face significant fines, especially if they fail to implement adequate security measures to protect personal data.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to PHI, violating HIPAA's security and privacy rules. This could result in penalties and mandatory corrective actions.
• PCI DSS (Payment Card Industry Data Security Standard): If the affected system processes or stores payment card information, this vulnerability could lead to unauthorized access to cardholder data, violating PCI DSS requirements and potentially resulting in fines or loss of payment processing capabilities.
• Other industry-specific regulations: Depending on the sector, organizations may be subject to additional regulations (e.g., SOX, FISMA) that require protection against unauthorized access and data breaches. Exploitation of this vulnerability could lead to non-compliance with these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Spring Boot Admin Server to version 4.1.2 or later, as this version includes fixes for the SSRF vulnerability.
• If upgrading is not immediately possible, restrict access to the /instances endpoint to authenticated users only. Configure proper authentication and authorization mechanisms.
• Implement network-level controls to block requests to internal or private IP ranges from the Spring Boot Admin Server.
• Monitor and log all instance registration attempts, especially those with unusual or external healthUrl and managementUrl parameters.
• Disable actuator proxy endpoints if they are not required, or restrict their access to trusted sources only.

Useful 0 Not Useful 0