CVE-2026-22731: spring spring boot
Vulnerability summary
CVE-2026-22731 is a high (CVSS 8.2) vulnerability in spring spring boot. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 19-03-2026PublishedVulnerability first disclosed.
- 20-03-2026Last modifiedVulnerability information updated.
Description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · MavenEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
+0.01 pp
From 0.33% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Chainguard5 products
- apache-nifi-registry< 2.8.0-r3
- camunda-8.8< 8.8.22-r0
- camunda-zeebe-8.6< 8.6.39-r0
- camunda-zeebe-8.7< 8.7.27-r0
- camunda-zeebe-8.8< 8.8.22-r0
Org.springframework.boot1 product
- spring-boot-starter-actuator≥ 3.4.0, ≤ 3.4.13 | ≥ 3.5.0, < 3.5.12 | ≥ 4.0.0-M1, < 4.0.4
Spring1 product
- spring boot≥ 4.0, < 4.0.3 | ≥ 3.5, < 3.5.11 | ≥ 3.4, < 3.4.15
Vmware1 product
- spring_boot≥ 3.4.0, < 3.4.15 | ≥ 3.5.0, < 3.5.12 | ≥ 4.0.0, < 4.0.4
Wolfi1 product
- apache-nifi-registry< 2.8.0-r3
5 vendors · 9 products
