Skip to content
OpenAdvisories
High WID-SEC-2026-1263 8 CVEs

VMware Tanzu Spring Boot: Mehrere Schwachstellen

Published Apr 23, 2026 · Updated Jun 28, 2026 · Revision 9 · de-DE

Vendor: HCL Software Vendor: IBM Vendor: Red Hat Vendor: VMware Tanzu Product: Commerce Product: Enterprise Linux Product: InfoSphere Information Server Product: openshift Product: Spring Boot Product: Sterling Connect:Direct Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.

Product

Spring Boot ist ein Framework zur Entwicklung von Java Anwendungen. Spring Boot basiert auf dem Spring Framework.

Vulnerabilities 8

  • Critical 9.1
    CVE-2026-40976

    Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

    In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and r…

    Spring Spring Boot apache-nifi-registry apache-nifi-registry-toolkit Wolfi Maven
  • High 7.5
    CVE-2026-40972

    Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

    An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, …

    Spring Spring Boot org.springframework.boot:spring-boot-devtools Maven
  • High 7.0
    CVE-2026-40973

    Spring Boot accepts predictable temp directory without ownership verification

    A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the atta…

    Spring Spring Boot thingsboard-tb-node thingsboard-tb-mqtt-transport Wolfi Maven
  • Medium 5.0
    CVE-2026-40970

    Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.

    When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

    Spring Spring Boot org.springframework.boot:spring-boot-elasticsearch Maven
  • Medium 5.0
    CVE-2026-40971

    Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

    When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

    Spring Spring Boot org.springframework.boot:spring-boot-rabbitmq Maven
  • Medium 5.0
    CVE-2026-40974

    Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

    Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19),…

    Spring Spring Boot org.springframework.boot:spring-boot-cassandra Maven
  • Medium 4.8
    CVE-2026-40975

    Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

    Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (f…

    Spring Spring Boot org.springframework.boot:spring-boot-cassandra Maven
  • Medium 4.7
    CVE-2026-40977

    Spring Boot's PID file write follows symlinks at predictable default path

    When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.…

    Spring Spring Boot org.springframework.boot:spring-boot-cassandra Maven

Revision history

  1. #9

    Neue Updates von IBM aufgenommen

  2. #8

    Neue Updates von Red Hat aufgenommen

  3. #7

    Neue Updates von IBM aufgenommen

  4. #6

    Neue Updates von Red Hat aufgenommen

  5. #5

    Neue Updates von Red Hat aufgenommen

  6. #4

    Neue Updates von Red Hat aufgenommen

  7. #3

    Neue Updates aufgenommen

  8. #2

    Referenz(en) aufgenommen: EUVD-2026-25908, EUVD-2026-25936, EUVD-2026-25930, EUVD-2026-25941, EUVD-2026-25940, EUVD-2026-25939, EUVD-2026-25938, EUVD-2026-25937

  9. #1

    Initiale Fassung

References