{"schemaVersion":3,"id":"CVE-2026-22746","aliases":["CGA-246w-465q-vxwq","CGA-4fp6-j9j7-m4mv","CGA-763j-hpqf-j8mj","CGA-7g29-qpm6-j999","CGA-f2f3-c82p-7phc","CGA-h6hh-jhp4-c4h7","CGA-hr38-6756-f324","CGA-j474-mvj8-55j8","CGA-ph8h-m4c4-q3vq","CGA-q8vj-qxmx-h894","CGA-vfhv-6vxg-whqw","CGA-w99v-5jqh-2j4c","CGA-272w-h722-7w2h","CGA-2ffr-32j5-3fch","CGA-2rwm-x9m3-v75f","CGA-2vpq-w26g-w42v","CGA-2ww5-vhfv-hv6f","CGA-37mx-fmxx-236r","CGA-3h93-wvh5-xhcq","CGA-3mj4-mf5q-mqxj","CGA-3xr5-7x7g-57p4","CGA-528h-gg5g-h6ch","CGA-5f7q-rggq-4cxm","CGA-5vmr-f6gw-qjr3","CGA-5xjh-xgjc-5qcj","CGA-66w3-4fhj-gh3x","CGA-67h4-qhgw-7q5j","CGA-6vc5-h7q2-xjrr","CGA-76r5-hm54-mfhm","CGA-7rcr-c5xg-9gv5","CGA-93mg-3rwx-5pf7","CGA-94fc-mxvq-4r77","CGA-99mq-c4fv-7fg3","CGA-9f6q-4vv9-c56h","CGA-9r73-64r7-974v","CGA-f3x2-wv8j-r95j","CGA-f7xj-m9gp-r42h","CGA-g2wf-wp7x-3vxg","CGA-g3cm-whw3-cc95","CGA-g682-8698-cf95","CGA-g9cf-pfx8-9c3r","CGA-gg5m-jch6-g2fx","CGA-gj4p-pvqq-m623","CGA-h298-77w5-c754","CGA-hq5r-w6f5-q29f","CGA-j8x7-wv5w-6934","CGA-jhx8-ff4r-42c8","CGA-m38c-hj36-vrcm","CGA-m9vm-jrpj-28j6","CGA-pf2m-97mh-6cmw","CGA-phx4-mg8m-vh4j","GHSA-vxf7-qj7q-83fh","CGA-q5g8-5j8v-c75c","CGA-q7mp-6q3x-2xj7","CGA-qfv9-457p-2ghg","CGA-r5rf-fmrq-vq47","CGA-rcxj-mg7q-2fm2","CGA-vhh8-6c42-f7vj","CGA-vjw5-h8h4-p2c6","CGA-w2fj-wp4g-7c6q","CGA-w56h-2xxf-xvc8","CGA-x9c8-mrq8-6pg3","CGA-xg2v-m7c5-j33v"],"status":"published","duplicateOf":null,"title":null,"description":"Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.","dates":{"published":"2026-04-22T05:02:24.327Z","modified":"2026-04-22T13:36:42.801Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.7,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00215,"percentile":0.11101,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00215},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00215,"percentile":0.11101}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00215,"percentile":0.11101}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-208","name":"Observable Timing Discrepancy","description":"Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/208.html"}],"affected":[{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-8.8","name":"camunda-8.8","label":"camunda-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-8.8","purlType":"apk","versions":[{"text":"< 8.8.24-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.24-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.6","name":"camunda-zeebe-8.6","label":"camunda-zeebe-8.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.7","name":"camunda-zeebe-8.7","label":"camunda-zeebe-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.7","purlType":"apk","versions":[{"text":"< 8.7.29-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.7.29-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.8","name":"camunda-zeebe-8.8","label":"camunda-zeebe-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.8","purlType":"apk","versions":[{"text":"< 8.8.24-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.24-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.9","name":"camunda-zeebe-8.9","label":"camunda-zeebe-8.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.9","purlType":"apk","versions":[{"text":"< 8.9.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.9.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor","name":"conductor","label":"conductor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor","purlType":"apk","versions":[{"text":"< 3.31.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor-fips","name":"conductor-fips","label":"conductor-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor-fips","purlType":"apk","versions":[{"text":"< 3.31.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.27","name":"geoserver-2.27","label":"geoserver-2.27","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.27","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.28","name":"geoserver-2.28","label":"geoserver-2.28","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.28","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-17","name":"jenkins-2.528-openjdk-17","label":"jenkins-2.528-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-17","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.528-openjdk-21","name":"jenkins-2.528-openjdk-21","label":"jenkins-2.528-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.528-openjdk-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541","name":"jenkins-2.541","label":"jenkins-2.541","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-17","name":"jenkins-2.541-openjdk-17","label":"jenkins-2.541-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-17","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.541-openjdk-21","name":"jenkins-2.541-openjdk-21","label":"jenkins-2.541-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.541-openjdk-21","purlType":"apk","versions":[{"text":"< 2.541.3-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.541.3-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui","name":"kafbat-ui","label":"kafbat-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui","purlType":"apk","versions":[{"text":"< 1.4.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui-fips","name":"kafbat-ui-fips","label":"kafbat-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui-fips","purlType":"apk","versions":[{"text":"< 1.4.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.0","name":"kayenta-2025.0","label":"kayenta-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.1","name":"kayenta-2025.1","label":"kayenta-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.2","name":"kayenta-2025.2","label":"kayenta-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.0","name":"kayenta-fips-2025.0","label":"kayenta-fips-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.1","name":"kayenta-fips-2025.1","label":"kayenta-fips-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.2","name":"kayenta-fips-2025.2","label":"kayenta-fips-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ranger","name":"ranger","label":"ranger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ranger","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.9.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-25","name":"jenkins-2-openjdk-25","label":"jenkins-2-openjdk-25","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-25","purlType":"apk","versions":[{"text":"< 2.555.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.555.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"org.springframework.security","product":"spring-security-core","name":"org.springframework.security:spring-security-core","label":"spring-security-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.security/spring-security-core","purlType":"maven","versions":[{"text":"≥ 5.7.0, ≤ 5.7.22","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, ≤ 5.8.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, ≤ 6.3.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.7.0, ≤ 5.7.22 | ≥ 5.8.0, ≤ 5.8.24 | ≥ 6.3.0, ≤ 6.3.15 | ≥ 6.4.0, ≤ 6.4.15 | ≥ 6.5.0, < 6.5.10 | ≥ 7.0.0, < 7.0.5","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-security","label":"Spring Security","category":"framework"}},"hubHref":null},{"vendor":"spring","product":"spring security","name":"Spring Security","label":"spring security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.7.0, ≤ 5.7.22","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, ≤ 5.8.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, ≤ 6.3.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, ≤ 6.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.7.0, ≤ 5.7.22 | ≥ 5.8.0, ≤ 5.8.24 | ≥ 6.3.0, ≤ 6.3.15 | ≥ 6.5.0, ≤ 6.5.9 | ≥ 7.0.0, ≤ 7.0.4","eol":null,"hubHref":"/vendor/spring/spring_security"},{"vendor":"vmware","product":"spring_security","name":"spring security","label":"spring_security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.7.23","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.8.0, < 5.8.25","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, < 6.3.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, < 6.4.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.7.23 | ≥ 5.8.0, < 5.8.25 | ≥ 6.3.0, < 6.3.16 | ≥ 6.4.0, < 6.4.16 | ≥ 6.5.0, < 6.5.10 | ≥ 7.0.0, < 7.0.5","eol":null,"hubHref":"/vendor/vmware/spring_security"}],"affectedCount":36,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2026-22746","label":"spring.io/security/cve-2026-22746","hostname":"spring.io","tags":["WEB","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22746.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22746.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22746","label":"nvd.nist.gov/vuln/detail/CVE-2026-22746","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-security","label":"github.com/spring-projects/spring-security","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-QMVM-MR2P-7QF9"]},"timeline":[{"kind":"published","date":"2026-04-22T05:02:24.327Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-22T13:36:42.801Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":15,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:22:10.205Z","stale":false,"partial":false}}