CVE-2026-8338: Authentication and Authorization Bypass in Coverity Connect
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8338?
CVE-2026-8338 has a critical severity rating of 9.2 based on the CVSS scoring system.
How do I fix CVE-2026-8338?
To fix CVE-2026-8338, update Coverity Connect to a version beyond 2026.3.0 immediately.
What is the risk associated with CVE-2026-8338?
The risk associated with CVE-2026-8338 is rated as 68, indicating a significant potential impact from exploitation.
What versions are affected by CVE-2026-8338?
CVE-2026-8338 affects Coverity Connect versions from 2023.6.0 to 2026.3.0.
Who can exploit CVE-2026-8338?
An unauthenticated malicious threat actor can exploit CVE-2026-8338 by sending specially crafted HTTP requests.