CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22733?
The severity of CVE-2026-22733 is considered high due to the potential for unauthorized access to sensitive application endpoints.
How do I fix CVE-2026-22733?
To fix CVE-2026-22733, ensure that authentication is properly enforced on all Actuator endpoints by updating your Spring Security configuration.
Which versions are affected by CVE-2026-22733?
CVE-2026-22733 affects Spring Security versions between 2.7.0 to 2.7.31, 3.3.0 to 3.3.17, 3.4.0 to 3.4.14, 3.5.0 to 3.5.11, and 4.0.0 to 4.0.3.
Is CVE-2026-22733 applicable to Spring Boot applications?
Yes, CVE-2026-22733 is specifically applicable to Spring Boot applications that utilize Actuator endpoints.
What type of vulnerability is CVE-2026-22733?
CVE-2026-22733 is classified as an authentication bypass vulnerability.