GHSA-8hfc-fq58-r658
Spring Boot has an Authentication Bypass under Actuator Health groups paths
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-22731
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.springframework.boot:spring-boot-starter-actuator | introduced 3.4.0, last affected 3.4.13 |
| Maven · org.springframework.boot:spring-boot-starter-actuator | introduced 3.5.0, fixed 3.5.12 |
| Maven · org.springframework.boot:spring-boot-starter-actuator | introduced 4.0.0-M1, fixed 4.0.4 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-22731 ADVISORY
- https://github.com/spring-projects/spring-boot PACKAGE
- https://spring.io/security/cve-2026-22731 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |