Spring Security Advisories

RSS feed

Default security filter chain has no authorization rule with Actuator but without Health

CRITICAL | APRIL 23, 2026 | CVE-2026-40976

Description

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must:

  • be a servlet-based web application
  • have no Spring Security configuration of its own and rely on the default web security filter chain
  • depend on spring-boot-actuator-autoconfigure
  • not depend on spring-boot-health

If any of the above does not apply, the application is not vulnerable.

Affected Spring Products and Versions

Spring Boot:

  • 4.0.0 - 4.0.5

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
4.0.6OSS

No further mitigation steps are necessary.

References

History

  • 2026-04-23: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all