CVE-2026-62242 is a server-side request forgery vulnerability in codecentric's Spring Boot Admin Server before version 4.1.2. The vulnerability arises because the application does not validate the healthUrl and managementUrl parameters against private IP ranges or cloud metadata endpoints when registering instances. As a result, unauthenticated attackers can force the server to send HTTP requests to internal network addresses and access response data through the actuator proxy. This can be leveraged to exfiltrate sensitive information such as cloud credentials.

An unauthenticated attacker can exploit this SSRF vulnerability to make the Spring Boot Admin Server perform HTTP requests to arbitrary internal addresses. This can lead to unauthorized access to internal services and retrieval of sensitive data, including cloud credentials, via the actuator proxy. The vulnerability has a high severity with a CVSS 4.0 base score of 7.7, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 4.1.2, upgrading to version 4.1.2 or later is recommended once an official fix is released. Until then, restrict access to the Spring Boot Admin Server and monitor for suspicious activity related to instance registration. Avoid exposing the server to untrusted networks.