CVE-2026-22731

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

PUBLISHED Reserved 2026-01-09 | Published 2026-03-19 | Updated 2026-03-20 | Assigner vmware

Problem types

CWE-288 Authentication bypass using an alternate path or channel

Product status

References

spring.io/security/cve-2026-22731

cve.org (CVE-2026-22731)

nvd.nist.gov (CVE-2026-22731)

Download JSON