CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2026-22731
High (8.1) in vmware spring boot. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in org.springframework.boot:spring-boot-starter-actuator 3.5.12, 4.0.4.
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-306, CWE-288
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_boot
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8hfc-fq58-r658 | Maven | org.springframework.boot:spring-boot-starter-actuator | >=3.4.0 <=3.4.13 | no fix published |
| GHSA-8hfc-fq58-r658 | Maven | org.springframework.boot:spring-boot-starter-actuator | >=3.5.0 <3.5.12 | 3.5.12 |
| GHSA-8hfc-fq58-r658 | Maven | org.springframework.boot:spring-boot-starter-actuator | >=4.0.0-M1 <4.0.4 | 4.0.4 |