Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints.

More precisely, an application can be vulnerable when all the following are true:

• the application is a web application
• the application has the Actuator dependency on the classpath
• the application has the Spring Security dependency on the classpath
• the application contributes an application endpoint that requires authentication under a subpath, like "/cloudfoundryapplication/admin"

Note that mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and that doing so is likely to interfere with other configurations and cause behavior problems. While the severity for this advisory is high, we expect this setup to rarely occur in production.

This CVE is similar but not equivalent to CVE-2026-22731, as the conditions for exploit and vulnerable versions are different.

Affected Spring Products and Versions

Spring Boot:

• 4.0.0 - 4.0.3
• 3.5.0 - 3.5.11
• 3.4.0 - 3.4.14
• 3.3.0 - 3.3.17
• 2.7.0 - 2.7.31

Older, unsupported versions are also vulnerable.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was responsibly reported by Gyu-hyeok Lee (g2h).

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N&version=3.1

History

• 2026-03-19: Initial vulnerability report published.