EUVD-2026-43556

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0 <=0.5.24), cn.home1:oss-admin (>=1.0.6.OSS <=1.0.7.OSS) +56 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=1.0.2 <=2.7.15)

de.codecentric:spring-boot-admin-server MAVEN version =1.0.2, =0.5.0, =1.0.6.OSS, =1.2.3-RELEASE, =3.0.3.RELEASE, =1.0.0, =1.1.3, =3.0.10, =1.0.0, =5.0.18, =1.5.0-Beta, =1.5.1-RC - com.wudgaby.platform:health-admin-server =1.0.5 and more Source cves: CVE-2023-38286 Source advisory:...

com.netcetera.girders.demos:girders-demo-adminserver (>=6.0.0 <=6.1.0), com.senzhikong:depend-cloud-monitor (>=1.1.0 <=1.1.1) +11 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=3.0.0 <=3.1.1)

de.codecentric:spring-boot-admin-server MAVEN version =3.0.0, =6.0.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.0-RC4, =7.0.0-RC6 Source cves: CVE-2023-38286 Source advisory: OSV:GHSA-7GJ7-224W-VPR3...