CVE-2022-46166: Arbitrary Code Execution in Spring Boot Admin
Summary
CVE-2022-46166: Spring Boot Admins integrated notifier support allows arbitrary code execution. Affects de.codecentric:spring-boot-admin across 3 version ranges.
< 2.6.10
>= 2.7.0, < 2.7.8
>= 3.0.0-M1, < 3.0.0-M6
Fixed in 2.6.10, 2.7.8 or 3.0.0-M6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Boot Admin is a tool that provides a user interface for managing and monitoring Spring Boot applications. It allows administrators to view application details, metrics, and logs, as well as perform various management tasks. The tool integrates with different notifiers, such as Teams-Notifier, to send notifications for specific events. However, a vulnerability in Spring Boot Admin's integrated notifier support allows for arbitrary code execution.
Vulnerability Detail
The vulnerability affects all users who run Spring Boot Admin Server and have enabled notifiers with write access to environment variables via the user interface. An attacker can exploit this vulnerability by injecting malicious code using the SpEL (Spring Expression Language) injection technique. This can lead to arbitrary code execution, potentially compromising the server and the underlying system. The impact of this vulnerability is high, as it allows an attacker to execute arbitrary code with the privileges of the Spring Boot Admin Server.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.102.6.10 -
>= 2.7.0, < 2.7.82.7.8 -
>= 3.0.0-M1, < 3.0.0-M63.0.0-M6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the fixed versions is not immediately possible, there are two workarounds available:
-
Disable any notifier: By disabling notifiers, the vulnerable functionality is effectively removed, reducing the risk of exploitation.
-
Disable write access on the
/envactuator endpoint: This can be done by configuring the server to disallow POST requests to the/envendpoint. This prevents attackers from injecting malicious code through the user interface.
Conclusion
The vulnerability in Spring Boot Admin's integrated notifier support allows for arbitrary code execution, potentially compromising the server and the underlying system. It is crucial to update to the fixed versions (2.6.10 and 2.7.8) or apply the provided workarounds to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for de.codecentric:spring-boot-admin →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
SpEL injection is a technique where an attacker can inject malicious code into an application by exploiting the Spring Expression Language (SpEL) feature. In this vulnerability, an attacker can inject arbitrary code through the user interface, leading to code execution.
The potential consequences of this vulnerability include unauthorized access to sensitive data, server compromise, and the ability to execute arbitrary code on the affected system. It is crucial to patch or mitigate this vulnerability to prevent these potential consequences.
No, not all versions of Spring Boot Admin are affected. The vulnerability exists in versions prior to 2.6.10 and 2.7.8. It is recommended to update to these fixed versions or apply the provided workarounds to secure the system.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is essential to patch or mitigate the vulnerability as soon as possible to prevent potential exploitation.
