PT-2026-26429 · Vmware · Spring Boot

G2H + 1 · Published 2026-03-19 · Updated 2026-05-15 · CVE-2026-22731

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions prior to 4.0.3 Spring Boot versions prior to 3.5.11 Spring Boot versions prior to 3.4.15

Description Spring Boot applications utilizing the Actuator feature may be susceptible to an authentication bypass issue. This occurs when an application endpoint requiring authentication is defined under a specific path that is already configured for an additional Health Group path. The issue allows bypassing the intended authentication mechanisms for certain endpoints.

Recommendations Update Spring Boot to version 4.0.3 or later. Update Spring Boot to version 3.5.11 or later. Update Spring Boot to version 3.4.15 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Missing Authentication

Weakness Enumeration

CWE-288

CWE-306

Related Identifiers

CVE-2026-22731

GHSA-8HFC-FQ58-R658

Affected Products

Spring Boot

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-22731 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-22731 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hfc-fq58-r658 · Vendor Advisory
• https://spring.io/security/cve-2026-22731 · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CCBalert/status/2034999433377481214 · Twitter Post
• https://twitter.com/herodevs/status/2037264901849440386 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034842830712037791 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2034999903915843622 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034772771511943438 · Twitter Post
• https://twitter.com/CVEnew/status/2034841523272261830 · Twitter Post
• https://twitter.com/f1tym1/status/2055219002473861335 · Twitter Post