REDHAT-BUG-2449290: Medium severity Spring Spring Boot vulnerability
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2449290?
The severity of REDHAT-BUG-2449290 is considered critical due to the potential for authentication bypass in Spring Boot applications.
How do I fix REDHAT-BUG-2449290?
To fix REDHAT-BUG-2449290, upgrade your Spring Boot application to version 4.0.4 or later, or 3.5.12 or later.
Which versions of Spring Boot are affected by REDHAT-BUG-2449290?
REDHAT-BUG-2449290 affects Spring Boot versions from 4.0 up to 4.0.3, and 3.5 up to 3.5.11, including 3.4 up to 3.4.15.
Can REDHAT-BUG-2449290 allow unauthorized access?
Yes, REDHAT-BUG-2449290 can potentially allow unauthorized access to protected endpoints due to the authentication bypass vulnerability.
Are there any known exploits for REDHAT-BUG-2449290?
As of now, there are no specific public exploits reported for REDHAT-BUG-2449290, but the vulnerability itself poses significant security risks.