PT-2026-26429 · Vmware · Spring Boot

G2H + 1 · CVE-2026-22731 · Published 2026-03-19 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions prior to 4.0.3 Spring Boot versions prior to 3.5.11 Spring Boot versions prior to 3.4.15

Description Spring Boot applications utilizing the Actuator feature may be susceptible to an authentication bypass issue. This occurs when an application endpoint requiring authentication is defined under a specific path that is already configured for an additional Health Group path. The issue allows bypassing the intended authentication mechanisms for certain endpoints.

Recommendations Update Spring Boot to version 4.0.3 or later. Update Spring Boot to version 3.5.11 or later. Update Spring Boot to version 3.4.15 or later.

Exploit

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2026-22731

GHSA-8HFC-FQ58-R658

Affected Products

Spring Boot

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22731.json · Exploit
• https://osv.dev/vulnerability/GHSA-8hfc-fq58-r658 · Vendor Advisory
• https://spring.io/security/cve-2026-22731 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22731 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-22731 · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/herodevs/status/2037264901849440386 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034772771511943438 · Twitter Post
• https://twitter.com/CCBalert/status/2034999433377481214 · Twitter Post
• https://twitter.com/f1tym1/status/2055219002473861335 · Twitter Post
• https://twitter.com/CVEnew/status/2034841523272261830 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034842830712037791 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2034999903915843622 · Twitter Post