CVE-2022-46166
Spring Boot Admins integrated notifier support allows arbitrary code execution
CVE-2022-46166 is a high vulnerability (CVSS 8.1) in Codecentric Spring Boot Admin, published December 9, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in de.codecentric:spring-boot-admin 2.6.10.
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring Boot Admins integrated notifier support allows arbitrary code execution
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.
- Record
CVE-2022-46166- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-7754
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.
- Record
EUVD-2022-7754- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w3x5-427h-wfq6
Spring Boot Admins integrated notifier support allows arbitrary code execution
Impact
All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.
Patches
In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionContext of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).
Workarounds
- Disable any notifier
- Disable write access (POST request) on
/envactuator endpoint
- Record
GHSA-w3x5-427h-wfq6- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.
- Record
CVE-2022-46166- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Spring Boot Admins integrated notifier support allows arbitrary code execution
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.
- Record
CVE-2022-46166- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-w3x5-427h-wfq6
Spring Boot Admins integrated notifier support allows arbitrary code execution
Impact
All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.
Patches
In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionContext of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).
Workarounds
- Disable any notifier
- Disable write access (POST request) on
/envactuator endpoint
- Record
GHSA-w3x5-427h-wfq6- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
de.codecentric:spring-boot-adminMaven |
before 2.6.10 | 2.6.10 |
de.codecentric:spring-boot-adminMaven |
2.7.0 up to 2.7.8 | 2.7.8 |
de.codecentric:spring-boot-adminMaven |
3.0.0-M1 up to 3.0.0-M6 | 3.0.0-M6 |
de.codecentric:spring-boot-adminMaven |
before 2.6.10, plus listed versions 1.0.21.0.31.0.41.0.51.1.0 Show 45 moreShow less1.1.11.1.21.2.01.2.11.2.21.2.31.2.41.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.4.01.4.11.4.21.4.31.4.41.4.51.4.61.5.01.5.11.5.21.5.31.5.41.5.51.5.61.5.72.0.02.0.12.0.22.0.32.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.0 |
2.6.10 |
de.codecentric:spring-boot-adminMaven |
2.7.0 up to 2.7.8, plus listed versions 2.7.12.7.22.7.32.7.42.7.52.7.62.7.7 |
2.7.8 |
de.codecentric:spring-boot-adminMaven |
3.0.0-M1 up to 3.0.0-M6, plus listed versions 3.0.0-M23.0.0-M33.0.0-M43.0.0-M5 |
3.0.0-M6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/codecentric__spring-boot-admin_CVE-2022-46166_2-6-9 | 2025-08-17 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
github.com/codecentric/spring-boot-admin/security/advisories/GHSA-w3x5-427h-wfq6
nvd.nist.gov/vuln/detail/CVE-2022-46166
Left out here: 28 versions. The JSON record has them.