Spring Boot Admin vulnerabilities

3 known vulnerabilities in Spring Boot Admin from Codecentric. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  spring-boot-admin: Server-Side Request Forgery

  CVE-2026-62242Jul 13, 2026Codecentric

  Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges

• 7.5 High severity

  Spring Boot Admin: Improper Neutralization of Special Elements used in a Command

  CVE-2023-38286Jul 14, 2023Codecentric

  Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-adm

• 9.8 Critical severity

  spring-boot-admin: Improper Control of Generation of Code

  CVE-2022-46166Dec 9, 2022CodecentricEPSS 1.63%

  Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affec