CVE-2026-62242 describes an SSRF vulnerability in codecentric's spring-boot-admin server prior to version 4.1.2. The vulnerability arises because the server does not validate the healthUrl and managementUrl parameters against private IP ranges or metadata endpoints when registering instances. This allows unauthenticated attackers to force the server to send HTTP requests to internal network addresses and access the response bodies through the actuator proxy. The vulnerability is rated with a CVSS 4.0 score of 7.7 (high severity), indicating network attack vector, no privileges or user interaction required, and high scope impact. No official patch or remediation level is provided in the available data, and no known exploits in the wild have been reported.

An attacker can exploit this SSRF vulnerability to make the Spring Boot Admin Server perform HTTP requests to arbitrary internal network addresses. This can lead to unauthorized access to internal services and potentially exfiltrate sensitive information such as cloud credentials via the actuator proxy. The vulnerability affects unauthenticated attackers, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.1.2, upgrading to version 4.1.2 or later is recommended once an official fix is available. Until then, restrict access to the Spring Boot Admin Server and monitor for suspicious registration attempts involving healthUrl and managementUrl parameters.