Codecentric vulnerabilities
We track 3 vulnerabilities in Codecentric products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 13, 2026.
Latest Codecentric vulnerabilities
- 8.6 High severity
spring-boot-admin: Server-Side Request Forgery
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges
- 7.5 High severity
Spring Boot Admin: Improper Neutralization of Special Elements used in a Command
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-adm
- 9.8 Critical severity
spring-boot-admin: Improper Control of Generation of Code
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affec