Description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Boot | 4.0 – < 4.0.3, 3.5 – < 3.5.11, 3.4 – < 3.4.15 | 4.0.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi-registry | 2.8.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 3.4.0, <= 3.4.13 | — | GHSA-8hfc-fq58-r658 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 3.5.0, < 3.5.12 | 3.5.12 | GHSA-8hfc-fq58-r658 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | >= 4.0.0-M1, < 4.0.4 | 4.0.4 | GHSA-8hfc-fq58-r658 |
Advisories 3
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-0799 VMware Tanzu Spring Boot Actuator: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 21, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026