EUVD-2026-43556

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62242

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62242: Server-Side Request Forgery (SSRF)

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: -...

de.codecentric:spring-boot-admin-example (1.0.4) potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.0.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-example 1.0.4 Source cves: CVE-2023-38286 Source...

de.codecentric:spring-boot-admin-sample (1.2.0), de.codecentric:spring-boot-admin-sample-discovery (1.2.0) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.0 -...

de.codecentric:spring-boot-admin-sample (1.2.2), de.codecentric:spring-boot-admin-sample-discovery (1.2.2) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.2)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.2 -...

de.codecentric:spring-boot-admin-sample (1.2.3), de.codecentric:spring-boot-admin-sample-discovery (1.2.3) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.3)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.3 -...

de.codecentric:spring-boot-admin-sample (1.3.0), de.codecentric:spring-boot-admin-sample-discovery (1.3.0) +2 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.3.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.3.0 -...

de.codecentric:spring-boot-admin-sample (1.4.1), de.codecentric:spring-boot-admin-sample-consul (1.4.1) +4 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.4.1)

de.codecentric:spring-boot-admin-server MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.4.1 -...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), de.codecentric:spring-boot-admin-sample (1.4.4) +6 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.4.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.7.oss - de.codecentric:spring-boot-admin-samp...

de.codecentric:spring-boot-admin-sample (1.5.0), de.codecentric:spring-boot-admin-sample-consul (1.5.0) +6 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.5.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.5.0 -...

com.ecfront.dew:monitor (1.2.2-rc), de.codecentric:spring-boot-admin-sample (1.5.4) +7 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.5.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - com.ecfront.dew:monitor 1.2.2-rc - de.codecentric:spring-boot-admin-sample 1.5.4 ...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), cn.tworice:tworice-monitor-starter (>=1.2.3-release, <=1.5.3) +48 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=2.0.0, <=2.7.15)

de.codecentric:spring-boot-admin-server MAVEN version =2.0.0, =0.5.0, =1.2.3-release, =3.0.3.release, =1.0.0, =1.1.3, =3.0.10, =1.0.0, =5.0.18, =2.0.1, =2.0.1, =2.0.0, =2.7.15 and more Source cves: CVE-2023-38286 Source advisory: GHSA-7GJ7-224W-VPR3...