PT-2026-35548 · Vmware · Spring Boot

Published 2026-04-27 · Updated 2026-06-05 · CVE-2026-40976

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5

Description Default web security in certain configurations is ineffective, allowing unauthorized and unauthenticated access to all endpoints. This occurs when a servlet-based web application relies on the default web security filter chain without its own Spring Security configuration, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health.

Recommendations Upgrade versions 4.0.0 through 4.0.5 to 4.0.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40976

GHSA-8V8J-3HXP-93WR

Affected Products

Spring Boot

References · 15

• https://osv.dev/vulnerability/GHSA-8v8j-3hxp-93wr · Vendor Advisory
• https://spring.io/security/cve-2026-40976 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-40976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40976 · Security Note
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CVEnew/status/2049350461921325299 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1syn4d4/spring_boot_flaw_allows_unauthorized_access_to · Reddit Post
• https://twitter.com/UpwindMDR/status/2049038973389914316 · Twitter Post
• https://twitter.com/lyrie_ai/status/2062765409426718969 · Twitter Post
• https://twitter.com/lyrie_ai/status/2062765410324258983 · Twitter Post
• https://t.me/CVEtracker/52002 · Telegram Post
• https://twitter.com/CCBalert/status/2049164243509862496 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049350939383845368 · Twitter Post
• https://twitter.com/threatcluster/status/2048862413106114575 · Twitter Post
• https://twitter.com/CVEarity/status/2049021745747882221 · Twitter Post