PT-2026-35548 · Spring · Spring Boot

Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-40976

NVD

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40976

Affected Products

Spring Boot

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40976 · Security Note
• https://spring.io/security/cve-2026-40976 · Note
• https://twitter.com/threatcluster/status/2048862413106114575 · Twitter Post