Log in Start free

Vulnerability · Published Apr 27, 2026 · Assigned by vmware

CVE-2026-40976

Critical 9.1

In plain English

A critical-severity missing authorization in Spring Boot from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.5%top 57.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.boot:spring-boot4.0.6GHSA-8v8j-3hxp-93wr

Affected products (as reported)

VendorProductVersions
Spring Spring Boot 4.0.0 – before 4.0.6

Weakness: CWE-862, CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References