Vulnerability · Published Mar 19, 2026 · Assigned by vmware
CVE-2026-22731Authentication Bypass under Actuator Health groups paths
High 8.2
In plain English
A high-severity authentication bypass in Spring Boot from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.boot:spring-boot-starter-actuator | no fix listed | GHSA-8hfc-fq58-r658 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | 3.5.12 | GHSA-8hfc-fq58-r658 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | 4.0.4 | GHSA-8hfc-fq58-r658 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Boot | 4.0 – before 4.0.33.5 – before 3.5.113.4 – before 3.4.15 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N