PT-2026-26429 · Vmware · Spring Boot

G2H + 1 · Publicado 2026-03-19 · Atualizado 2026-05-24 · CVE-2026-22731

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions prior to 4.0.3 Spring Boot versions prior to 3.5.11 Spring Boot versions prior to 3.4.15

Description Spring Boot applications utilizing the Actuator feature may be susceptible to an authentication bypass issue. This occurs when an application endpoint requiring authentication is defined under a specific path that is already configured for an additional Health Group path. The issue allows bypassing the intended authentication mechanisms for certain endpoints.

Recommendations Update Spring Boot to version 4.0.3 or later. Update Spring Boot to version 3.5.11 or later. Update Spring Boot to version 3.4.15 or later.

Correção

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-306

CWE-288

Identificadores relacionados

CVE-2026-22731

GHSA-8HFC-FQ58-R658

Produtos afetados

Spring Boot

Referências · 12

• https://github.com/spring-projects/spring-boot · Nota
• https://spring.io/security/cve-2026-22731 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2034772771511943438 · Publicação no Twitter
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-22731 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22731 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/2034999903915843622 · Publicação no Twitter
• https://twitter.com/f1tym1/status/2055219002473861335 · Publicação no Twitter
• https://twitter.com/herodevs/status/2037264901849440386 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8hfc-fq58-r658 · Aviso do Fabricante
• https://twitter.com/CCBalert/status/2034999433377481214 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034841523272261830 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2034842830712037791 · Publicação no Twitter