CVE-2026-22731: Authentication Bypass under Actuator Health groups paths
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22731?
CVE-2026-22731 is classified as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive application endpoints.
How do I fix CVE-2026-22731?
To fix CVE-2026-22731, update your Spring Boot application to version 4.0.4 or higher, or to version 3.5.12 or higher.
What causes CVE-2026-22731?
CVE-2026-22731 is caused by an authentication bypass in Spring Boot applications when certain actuator health group paths are accessed without proper authentication.
Which versions of Spring Boot are affected by CVE-2026-22731?
CVE-2026-22731 affects VMware Spring Boot versions 3.4.x, 3.5.x, and 4.0.x prior to their respective patched versions.
What are the potential impacts of CVE-2026-22731?
The potential impacts of CVE-2026-22731 include unauthorized access to application endpoints, which could lead to data exposure or manipulation.