CVE-2026-62242
🟡 Monitoruj
W Spring Boot Admin Server występuje podatność na atak SSRF, umożliwiająca wykradanie danych.
CVSS
8.6
EPSS
0.3%
Exploit
none
Vendor
Opis źródłowy (NVD)
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.
ssrf
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.6 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-07-13 22:16:52 UTC |
| Ostatnia modyfikacja (NVD) | 2026-07-15 21:02:41 UTC |
Referencje
- https://github.com/codecentric/spring-boot-admin/commit/1f991ea013e46360b8f8fb63fe4ad20a9bf0d551 (disclosure@vulncheck.com)
- https://github.com/codecentric/spring-boot-admin/issues/5452 (disclosure@vulncheck.com)
- https://github.com/codecentric/spring-boot-admin/pull/5464 (disclosure@vulncheck.com)
- https://github.com/codecentric/spring-boot-admin/releases/tag/4.1.2 (disclosure@vulncheck.com)
- https://www.vulncheck.com/advisories/spring-boot-admin-server-ssrf-via-unauthenticated-instance-registration (disclosure@vulncheck.com)