PT-2026-34254 · Vmware · Spring Security

Published 2026-04-22 · Updated 2026-05-07 · CVE-2026-22754

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 7.0.0 through 7.0.4

Description An issue exists where the servlet path is not included when computing a path matcher if an application uses '<sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/>' to define the servlet path. Consequently, the related authorization rules are not exercised, which can lead to an authorization bypass.

Recommendations Update Spring Security to a version later than 7.0.4.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-22754

GHSA-4VRC-J85C-598C

Affected Products

Spring Security

References · 7

• https://spring.io/security/cve-2026-22754 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vrc-j85c-598c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22754 · Security Note
• https://github.com/spring-projects/spring-security · Note
• https://twitter.com/pinakahq/status/2048253534328816106 · Twitter Post
• https://twitter.com/CVEnew/status/2047428157217943876 · Twitter Post
• https://twitter.com/cantinasecurity/status/2052436410851057720 · Twitter Post